ThummerThe Fake “Your Phone Was Found” Text: How the Scam Works
Your phone was stolen. Days, weeks or even months later, a message arrives: good news, your device has been located, tap here to see where it is. For many victims, that message is the second half of the theft.
What the messages look like
Switzerland’s National Cyber Security Centre (NCSC) warned in November 2025 about text messages and iMessages that appear to come from Apple and say a lost iPhone has been found abroad, sometimes months after it went missing. They include the phone’s model, color and storage size, read from the device itself. The link opens a fake Apple login page.
The same pattern turns up elsewhere:
- Email and text. Malwarebytes, a security company, says these lures arrive by text, iMessage or email (November 2025), and that thieves can get your contact details from a lost-mode message on the phone’s own lock screen.
- Fake police messages. In February 2026, the Polícia Civil da Bahia in Brazil warned about WhatsApp messages saying a victim’s phone had been located and was in police custody. Its advice: don’t click links, share personal data or pass on SMS codes. Earlier, in March 2023, Chile’s investigative police, the PDI, warned about similar WhatsApp messages claiming a Santiago cybercrime unit had recovered the recipient’s lost or stolen iPhone and pointing to a fake recovery site. The PDI said it doesn’t offer such services and told people to ignore the messages.
- Phone calls. In Bogotá, a theft victim said in a TikTok video, reported by Infobae in June 2025, that she received an SMS saying her iPhone had been located, automated calls posing as Apple that asked for her six-digit screen code, and a call from a man claiming to be a police officer.
- Hours, not months. Security firm ESET documented a case in which a fake “your iPhone has been located” SMS arrived a few hours after the theft (2019). The fake iCloud page asked for the login and then the phone’s unlock code.
In September 2024, police in Europe and Latin America took down iServer, a phishing service that sold access to people who unlock stolen phones. Investigators reported 483,000 victims worldwide (Europol, 2024), mostly Spanish speakers. According to SecurityWeek, victims got SMS messages with links to pages asking for their login details, which criminals then used to turn off Lost Mode and unlink the phones from their owners. Seventeen people were arrested in Argentina, Chile, Colombia, Ecuador, Peru and Spain (The Record, September 2024).
Why thieves want your password, not just your phone
On iPhone, Activation Lock means your Apple Account password is required before anyone can turn off Find My, erase the device, or reactivate and use it. The Swiss NCSC says there’s no known way around it, so the scammers’ real goal is to remove the Activation Lock by getting you to type in your password yourself. With the password, Malwarebytes suggests, a thief might also lock you out of your account and get into your photos and email.
What about Android? Most documented cases we found involve iPhones, and the Bahia police warning above doesn’t name any phone brand. We didn’t find an official advisory describing an Android-specific version. But Android works on the same principle: after a factory reset, Google’s protection requires the screen lock or your Google Account password, or the phone can’t be used at all. That gives a thief the same reason to want your Google password. Treat any “we found your phone” message about an Android phone exactly as you would an Apple one. (Our Android theft protection explainer covers these features in more detail.)
How to check for real
The simplest rule comes from Apple itself: Apple will never contact you to say that your iPhone or iPad has been found. Any message that says otherwise, and asks you to tap a link, is a scam.
To see where your phone actually is, go there yourself, typing the address into a browser rather than tapping a link:
- iPhone: Open the Find My app on another Apple device, or go to iCloud.com/find.
- Android: Go to Google’s Find Hub at android.com/find or google.com/android/find and sign in there.
The FTC’s general advice for any text from a company applies: contact it using a phone number or website you know is real, not the details in the message. The same goes for anyone claiming to be the police.
Two more precautions from Apple: if your phone was stolen, don’t include your contact information in the Lost Mode message, because a thief could use it to target you. And don’t remove the phone from Find My, since that removes Activation Lock.
If you already clicked or typed your password
Act quickly, from a device you trust:
- Change the password. Apple says that if you may have entered your password on a scam site, change your Apple Account password immediately and make sure two-factor authentication is on. Google says to change your Google Account password if you think someone else has access.
- Check the devices list. At account.apple.com, Apple says to remove any device you don’t recognize and confirm that only you control the email addresses and phone numbers on the account. On Google, review Your devices and your recent security events.
- If you’re locked out, use Apple’s recovery at iforgot.apple.com or Google’s account recovery page.
- Keep the phone in Find My or Find Hub, marked as lost.
- Change any reused passwords. Google advises changing the password on other sites where you use the same password, or that contact you at your Google email.
If banking apps were on the phone, read how thieves drain bank apps from a stolen phone, and run through our first-10-minutes checklist if you haven’t yet.
How to report it
- To Apple: Take a screenshot of a suspicious text and email it to reportphishing@apple.com. Forward suspicious emails to the same address.
- In the U.S.: The FTC says to forward spam texts to 7726 (SPAM), report them in your messaging app, and report them to the FTC at ReportFraud.ftc.gov.
- In the U.K.: The UK’s NCSC says most providers let you forward suspicious texts to 7726 for free. If you’ve lost money or been hacked, report it at reportfraud.police.uk or 0300 123 2040 in England, Wales or Northern Ireland, or to Police Scotland on 101.
- Elsewhere: Report it to local police and keep screenshots of the messages and calls. Chile’s PDI, for example, says complaints should go to a police unit or the public prosecutor’s office.
Traveling? See our guides for Bogotá and Medellín and Santiago.
Prevention starts before the theft
Turn on Find My or Find Hub, use a strong screen lock, and switch on your phone’s built-in theft protections. Some Android owners add an app for the moment of the grab itself; one option is Thummer, which locks an unlocked phone within five seconds if the owner’s thumb lifts off an on-screen bubble. None of these tools recovers a phone. And no real company or police force needs your password to give one back.
The bottom line
A “your phone was found” message is almost always bait. Don’t tap the link. Check Find My or Find Hub yourself, change your password if you slipped, and report the message.