ThummerHow Thieves Drain Bank Apps From a Stolen Phone
In the cases below, the phone was the smaller loss. The bigger one came afterward, when someone used it to reach the owner's money. This guide sticks to documented cases, explains how it happens only as far as a potential victim needs to know, and lists the settings and habits that make it harder. Most of them are free and take a few minutes.
What the cases show
- Minneapolis. In September 2022, the Hennepin County Attorney's Office charged 12 people over a theft ring. Prosecutors said more than 40 victims lost over $300,000. Most were targeted as they left bars and waited for a ride, and money moved out through Venmo, Zelle and Coinbase.
- London. In November 2024, four men were jailed in a case involving more than 5,000 stolen devices. Two of them used stolen phones to make purchases or take out loans, and one woman lost over £55,000 from her bank account.
- New York City. Police linked 22 grand larcenies from rideshare drivers between November 2024 and February 2025 to one pattern. In at least 10 of them, transactions on the victims' phones totaled more than $36,000.
- Chicago. In April 2025, police warned of at least 13 robberies by people posing as rideshare drivers. In several, the stolen phones were used to reach banking information and drain accounts.
- South Korea. Police in Daejeon arrested a man in July 2025 accused of withdrawing about 270 million won (roughly $198,700) from at least 45 small-business owners. Police said he took advantage of unlocked phones and searched memo apps and photo galleries for banking passwords.
Prosecutors have noticed. In January 2024, Manhattan District Attorney Alvin Bragg wrote to Venmo, Zelle and Cash App about crimes in which someone gets into an unlocked phone and drains bank accounts.
How it happens, in general terms
The phone is already open. A phone taken while in use has no lock in the way until something locks it. In New York, police said robbers asked rideshare drivers to change the destination, then took the phone while the app was still open (CBS New York, 2023).
The passcode was seen first. Boston police warned in 2025 that suspects watched victims enter their passwords before taking the phone. In the Minneapolis case, suspects made sure victims unlocked their phones. For many people the screen lock is the only thing guarding everything else.
The phone holds its own keys. Passwords saved in notes are one example; texted security codes are another. In a £73,000 case documented by Which? in 2023, a one-time code and even the bank's fraud warning went by text to the stolen phone. Boston police warn that two-factor authentication may be compromised, because a thief holding your phone may also have your email and texts.
What actually reduces the risk
None of these is a guarantee. Together, they add steps between a stolen phone and your money.
- Use a longer screen lock and guard it. Google recommends a PIN of six or more digits, a complex pattern or a unique password. In public, unlock with your fingerprint or face when you can, and shield the screen when you have to type a code.
- Give money apps their own lock. Boston police advise turning on the passcode option in banking and card apps. Venmo, for example, offers a passcode and biometric lock under Me > Settings (gear icon) > Preferences. Starling Bank advises an app passcode that differs from your lock screen code. Check your own bank's security settings.
- Clear passwords out of the phone. Boston police say don't store usernames and passwords on your device, and suggest signing out of apps when you're done. That includes notes, photos of cards and screenshots of account details.
- Turn on Identity Check (Android). Outside your trusted places, it requires a fingerprint or face, with no PIN fallback, for saved passwords, changing the screen lock, turning off Find Hub and more. Google says it now also covers apps that use Android's Biometric Prompt, such as third-party banking apps (Google blog, January 2026). It has limits: it's only on certain devices, and a PIN still works for payment autofill in apps and for password and payment autofill in Chrome. Find it under Settings > Google > All services > Theft protection. On Samsung phones it's under Settings > Security and privacy > Lost device protection > Theft protection, and away from your safe places some changes start a one-hour security delay.
- Check Stolen Device Protection (iPhone). Away from familiar places it requires Face ID or Touch ID for saved passwords and Safari payment autofill, with no passcode fallback, and adds a one-hour delay before changes such as a new Apple Account password. Apple says it might already be on by default; confirm under Settings > Face ID & Passcode. Apple notes the passcode still works for Apple Pay.
- Stop your phone from helping. Lock your SIM with a PIN and hide message previews on the lock screen, so codes don't appear for whoever holds the phone. Google lists both under Security & Privacy > More Security Settings, though menus vary by phone.
- Limit what one app can reach. Bragg's letters urged lower daily transfer limits and waiting periods for large transfers. Ask your bank which limits you can lower, and keep only what you need in payment apps. Some banks go further: UK banks Monzo and Starling have announced location-based limits on some withdrawals or transfers.
- Turn on remote tools now. Theft Detection Lock, Offline Device Lock and Remote Lock on Android, or Stolen Device Protection and Find My on iPhone, only help if they're on before the theft.
Another option guards the moment most of these settings don't: a phone grabbed while it's unlocked and in use. Apps like Thummer lock an Android phone when it's pulled from your hand.
If it happens
Let the phone go. Don't chase or fight; no phone is worth getting hurt. Then move fast, using our first-10-minutes checklist: lock the phone remotely, call your bank and card issuers, and change the passwords for your email and money apps from another device.
Speed matters for money too. Under U.S. rules summarized by the FTC (2022), your liability for a stolen credit card tops out at $50. For a debit or ATM card, it's $50 if you report within two business days of learning of the loss, up to $500 after that, and possibly everything taken if you wait more than 60 days after your statement is sent. These rules cover cards; app transfers can work differently, rules differ by country, and refunds aren't automatic. In the Which? case, Barclays refunded £15,000 from the personal account but declined to refund the business account's transfers. Report quickly and keep records of everything.
The bottom line
No app can stop a theft, and no setting makes a stolen phone harmless. What you can control is how many separate locks stand between that phone and your money, and how much one stolen device can reach. Set those up today, while it costs you nothing.