Miami Beach taxi thefts used drunk passengers' faces to unlock their iPhones and move money, police sayMiami Beach taxi thefts used drunk passengers' faces to unlock their iPhones and move money, police say

Miami Beach police have charged a taxi driver with kidnapping and fraud, saying he and an accomplice unlocked intoxicated passengers' iPhones with their faces and then moved money from their accounts.

CBS News Miami and NBC 6 Miami both reported the arrest on 30 September. The 48-year-old driver faces eight counts, including kidnapping, an organised scheme to defraud, offences against computer users, unlawful use of a communications device and conspiracy to commit strong-arm robbery. Police spokesman Christopher Bess told CBS the pair would use biometrics and the victims' faces to break into iPhones.

NBC 6 describes two incidents, both outside clubs on Washington Avenue. On 14 June a woman grabbed a victim's phone and left in the taxi, the phone was unlocked with the victim's face, and fraudulent purchases followed at Target. On 28 June an intoxicated man got into a taxi he had not called and was later left on 15th Street, after several bank transfers had been made from his phone. CBS reports that one victim was held down in the car.

Detectives traced the taxi with licence plate readers and found surveillance video of it waiting outside clubs for hours without taking fares, NBC 6 reports. When the driver was arrested, police found eight iPhones in a plastic bag under his seat. A female accomplice has been identified and is still being sought. Neither outlet gives the amounts taken or names the banking apps involved, and police believe there are more victims.

Why Stolen Device Protection does not stop this

Stolen Device Protection, in Settings under Face ID and Passcode, is Apple's main defence against phone theft, and it is built around a different attack: a thief who has watched the owner type a passcode. Away from familiar places, Apple's support page says, it requires Face ID or Touch ID with no passcode fallback to use saved passwords and cards, turn off Lost Mode or erase the phone, and it adds an hour's delay before the Apple Account password can be changed.

Every one of those checks is passed by the owner's own face. Apple's page also says that Apple Pay and third-party apps, which includes banking apps, are outside its scope. A thief with the phone and a compliant, drunk owner has what the feature asks for.

What actually protects an iPhone on a night out?

• Lock Face ID before you need to. Apple's Platform Security guide says a passcode is required after pressing and holding the side button and either volume button for two seconds, then pressing Cancel.
• Keep Require Attention for Face ID on, in Settings under Face ID and Passcode, so the phone needs open eyes looking at it.
• In each banking app, require the app's own PIN or passcode for transfers rather than Face ID, where the bank allows it.
• Set lower daily transfer limits with the bank, which caps the damage whatever unlocks the phone.

AppleInsider's weekly crime round-up carried three smaller cases. Two men were arrested over thefts at New Jersey malls that included 920.95 dollars of accessories from an Apple Store, according to TAPinto. In western Pennsylvania, CBS Pittsburgh reports that suspects used fake IDs and stolen cards to take more than 14,000 dollars of Apple products from Costco. And in Chesapeake, Virginia, an AirTag led police to a stolen food trailer, WAVY reports.

Our take

This case is a useful corrective to how phone security is usually discussed. The threat model for most of Apple's recent work has been the stranger who learns a passcode, and Apple has answered it well. The Miami Beach scheme did not need the passcode at all. It needed the owner, impaired and close at hand, and that turns the feature meant to prove you are you into the easiest way in.

We are not arguing that Face ID is weak. Requiring a live, attentive face defeats almost every casual thief, and nothing in either report suggests the protections were bypassed technically. The gap is that money now sits behind the same face that unlocks the phone. When we listed the iPhone settings worth setting up with an older relative, Stolen Device Protection was one of them, and it still belongs on any phone. It simply answers a different question.

APPDOOK's view is that the practical fix sits with banks as much as with Apple. An app that moves money should be able to demand something the owner knows, not only something the owner is, for a transfer to a new payee, and many already offer that as an option nobody switches on. Until that is the default, the two-second button press before a long night is the cheapest protection an iPhone has.