11

Few days back I gave my iPhone 6 to a shop to change the battery. The person asked me to remove the passcode so that he can check the battery status. I collected the iPhone later when the battery was fixed.

But now I think it was not a smart thing to do to remove my passcode and give the phone to someone else. I am now worried that he might possibly taken the backup of my iPhone to his iTunes and then restore it into a another iPhone. Will he get all my data in another iPhone?

Is there anything I can do now to prevent this?

Improve this question
5
  • 3
    Not an answer, but you should only really let Apple preform any repairs or maintenance on your Apple hardware. It won't outright prevent this sort of thing, but at least Apple employees have strict rules to follow, and if an Apple employee was found to be abusing a customers trust in this way, it would be big news/a scandal.
    – JMK
    Commented Jan 7, 2018 at 16:09
  • 4
    And to prevent that from happening, you could back up your phone and then just wipe it. Restoring it when you get it back. Yes that is a bit of a pain but guarantees your data is secure.
    – Steve Chambers
    Commented Jan 7, 2018 at 16:38
  • 2
    @JMK Apple has a terrible approach to repairs... for example they will not repair a broken motherboard, even if the problem is easily found in a broken 2$ capacitor that can be easily replaced; they will replace the whole motherboard charging you hundreds of dollars instead of about 50$ or so for the work that could fix the problem.
    – Bakuriu
    Commented Jan 7, 2018 at 22:31
  • see also apple.stackexchange.com/questions/310010/… it's normal for repair shop employees to scan your device for erotic content
    – Sybil
    Commented Jan 8, 2018 at 16:39
  • As discussed by other answers, one of the chief concerns is that a person can do two factor authentication and gain access to all your bank information and/or do identity theft on you. But one other thing to consider is, they can link their PC to your iTunes account and continue to sync your data for years to come. What you need to do is go to your iTunes account and check which computers are authorized and remove any that should not be. (But to be honest, this is a very unlikely scenario as they would need to somehow get around your iTunes password, but I would still check it.)
    – Vladimir
    Commented Jan 13, 2018 at 15:46

2 Answers 2

Reset to default
13

You should consider all device content compromised and it is too late to be prevented.

By removing the passcode, any new computer the device is connected to can be ‘trusted’ without any further authentication. The device can be backed up to iTunes and all the device content available to browse through or be restored to a new device.

If the backup was created ‘encrypted’ this includes all passwords on the device which may include your Apple ID password.

You should change any passwords which are linked to the device, such as Apple ID and email account passwords.

Improve this answer
5
  • 10
    You should not only consider all data that is on the phone "stolen" (i.e. assume the attacker has it) but also all data that is stored in accounts (e.g. iCloud, Dropbox, Facebook, Twitter, all of your email accounts) connected to the phone. Also, since the attacker had access to your phone and your email (on your phone), he would even have been able to perform actions that require two-factor-authentication via SMS such as sending password reset requests for pretty much every account you have and ever had. You should consider everything compromised. This really is an absolute worst-case …
    – Jörg W Mittag
    Commented Jan 7, 2018 at 13:45
  • … scenario security-wise.
    – Jörg W Mittag
    Commented Jan 7, 2018 at 13:45
  • 5
    @JörgWMittag I wouldn't say the absolute worst case as you do know the person who had unrestricted access to your phone. Not only does this give you a chance to gauge the person's trust worthiness, but also gives you someone to point the police to if necessary. So maybe like one or two steps down from absolute worst;p
    – Aequitas
    Commented Jan 8, 2018 at 3:13
  • This is not 100% correct: "If the backup was created ‘encrypted’ this includes all passwords on the device which may include your Apple ID password" Actually, if backups were encrypted prior to removing the passcode, then all future backups are password protected by a password that is separate from the passcode, and can't be decrypted.
    – Josh
    Commented Jan 11, 2018 at 22:29
  • @Josh This whole answer is worst-case scenario. The percentage of people who use iTunes backups is minuscule, and those who encrypt them even smaller. There's lots of ‘if you've done x then y should be safe’, but that sounds too idealistic. For example, all device content can be browsed through with direct USB access to the device when the computer is trusted, even without an iTunes backup, completely negating your entire point. There's too many possible vectors for data leaks when the passcode is removed that it's not worth classing even certain things ‘safe’.
    – grg ♦
    Commented Jan 12, 2018 at 8:38
5

Apple’s own advice for keeping data secure during repair:

For Macs: Keeping your confidential data secure during hardware repair

When your hard drive is replaced, the previous hard drive is returned to Apple and refurbished. As part of the refurbishment process, Apple erases and reformats all hard drives to help address any concerns about data security or identity theft.

You might send your computer for repair when the hard disk is still working—either the drive works intermittently or your hard drive isn't the issue requiring repair. If you are concerned about data security and your hard disk is still functioning, you should back up your important data and use the secure erase functions in Disk Utility (described below) to reformat your drive before sending in your computer for service.

Secure erase functions in Disk Utility

Your erase options depend on which version of OS X you have on your computer.

  • Mac OS X v10.4 and later includes additional secure erase options in Disk Utility. Note: With OS X Lion v10.7 or later and an SSD drive, Secure Erase and Erasing Free Space are not available in Disk Utility. These options are not needed for SSD because a standard erase makes it difficult to recover data from an SSD. For more security, consider turning on FileVault encryption when you start using an SSD. FileVault, available in Mac OS X v10.3 and later, prevents others from easily accessing any information contained within your Home folder, even if the drive unexpectedly stops working or is serviced.
  • Mac OS X v10.3.x and earlier include a Zero all Data function in Disk Utility that you can use to completely erase the drive.

Always remember to make a backup of your important data before using any erase or encryption options, as any rewriting of data includes a risk of data loss.

For iOS devices: Get your iPhone, iPad, or iPod touch ready for service

Before you bring in your device

Follow these steps before you take your device to an Apple Store, Apple Authorized Service Provider, or carrier. If your device won't turn on or respond, finish as many steps as possible:

  1. Back up your iOS device.
  2. Have your Apple ID password ready. For some repairs, you'll need your Apple ID password to erase your device and turn off Find My iPhone.*
  3. Bring your sales receipt (if possible), in case your service requires proof of purchase.
  4. Bring your device and any accessories that you need help with.
  5. Bring a form of personal identification, like a driver’s license, passport, or other government-issued ID.
  6. If you haven't already, call to check whether you need an appointment before you go to a service location. For example, schedule a Genius Bar reservation before you go to an Apple Store.

Before you send your device

Follow these steps before you send your device in for repair or replacement. If it won't turn on or respond, finish as many steps as possible:

  1. If you need to send in an iPhone that's paired with an Apple Watch, unpair your devices. When you unpair, your iPhone will create a new backup of your Apple Watch. You can use the backup to restore your Apple Watch when your iPhone returns from service.
  2. Back up your iOS device.
  3. Go to Settings > Messages and turn off iMessage.
  4. Erase your device. Go to Settings > General > Reset > Erase All Content and Settings. If asked, enter your passcode and Apple ID password. If you can't erase your device because it won't power on or isn't responding, you can erase it from iCloud.com. Learn how.
  5. Make sure that Activation Lock is disabled.
  6. Remove any SIM card, case, or screen protector from your device and keep your cable and charger.
Improve this answer
2
  • 2
    It's a good idea to spell whatever the links suggest in your answer, at least in a short form, in case the links go dead and your answer becomes useless.
    – Gallifreyan
    Commented Jan 7, 2018 at 19:31
  • 3
    This answer could be improved by removing the irrelevant portions of the quote. The question is about taking a phone in for repair, so information on wiping a computer hard drive or mailing in the phone isn't useful here.
    – Bobson
    Commented Jan 8, 2018 at 1:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .