You’ve given up the keys to the kingdom!
General rule of thumb: When someone has possession of your device, assume it can and will be compromised. That means all of the data including passwords and security keys.
she fell into their phishing trap and gave them her icloud password
This means they can use her Apple ID to reset the MacBook password. Once they do that, it is assumed that they are the owners of the device and can now take ownership of it.
What can they do in this case?
- Take ownership of the MacBook
- Take ownership of her iCloud account
- Remove her ability to use Find My and Wipe/Lock device
- Gain full access to Keychain
- Gain full access to all documents, software…basically everything.
This isn’t over..since they have access to everything on her device, possibly including personal info this means everything else is at risk.
- Banking and Financial accounts
- Personal videos, text messages, including everything she doesn’t want her mother to see
- Medical info
- Email and cell phone accounts
- Anything else attached to that laptop
What to do…
The two of you need to work together. One needs to call the police and report a stolen laptop, while the other begins calling all critical entities she deals with (banks, credit cards, etc.)
- Lock all credit cards and bank accounts
- Change all passwords on online accounts (email, Twiter, Facebook, etc.)
- Call the CRA’s (credit reporting agencies) and lock her credit file
- Have a friend/relative try to notify as many people in her circle her accounts were compromised and to ignore any requests from her account(s). Get the word out in case they try to phish others.
If you have shared accounts, you must do this yourself (and anyone else she shares accounts with). By this I mean things like an Amazon account, a Ring video doorbell, etc.
To respond to your question in comments about email notifications, the short answer is it is worthless at this time. If they’ve gained access to email from your laptop, they can respond and delete notification messages as they come in. They can unlink her phone from her Gmail account (for example) from Gmail’s settings.
The bottom line is by the time you receive and react to the email message, it’s a moot point.
Going Forward…
There are tons of security features implemented by Apple, email providers, etc. To help you thwart all of this:
- 2FA or two factor authentication. This will require her approving access on her phone. Not only does Apple support this, but almost every (reputable) online account/service offers this.
- FileVault will encrypt the drive with a different password from the AppleID. Without this, the MacBook is a boat anchor. The data will be secure and the only value the Mac will have is for parts (it will basically go to an electronic version of a “chop shop”)
However, the most important thing to remember is no matter what, never, ever, EVER, give out a password or 2FA challenge/response code to anyone over the phone..
For example, to verify my account with my credit card company, they will tell me they are generating a code and to enter it into my App; they also remind me not to tell them the code. If they want the code, it means an attacker is attempting to spoof themselves as you, but need the code that is sent to your mobile device. When you get it and tell them, they enter it and gain access to your device.
Final Thoughts…
The question Is My Mac Hacked gets asked quite often here and the answer is usually “no” because hacking is 90% social engineering. In this case, (very) unfortunately, it is a textbook case study in how systems are compromised by socially engineering your girlfriend into giving up credentials to take ownership of a device.
I genuine empathize for her and your current predicament and I don’t envy the amount work you’ve got in front of you to secure everything to protect her identity and financial well being. To make some good come from this, use it as a teaching moment to educate people in your/her circle on the dangers of not using the security features that come with technology and some simple rules to follow concerning password security.
