Fake Apple Support AI Calls Target Stolen-Device Owners for Passcodes and 2FA Codes

How the AI Voice Scam Exploits Trust in Brand Support

Cybersecurity researchers have uncovered a phishing-as-a-service operation that uses artificial intelligence to impersonate Apple Support and trick victims of device theft into revealing sensitive information. The scheme, identified in August 2026, targets individuals whose i Phones or i Pads have been stolen, aiming to bypass Apple’s Activation Lock security feature. By gaining access to passcodes and two-factor authentication codes, attackers can reactivate and resell the stolen devices.

The platform operates by renting AI-powered voice agents that make automated calls to victims, mimicking legitimate Apple Support representatives. During these calls, the synthetic voices claim to assist with recovering a lost device and urgently request the device passcode or 2FA codes under the guise of verifying ownership. Once obtained, this information allows criminals to disable Activation Lock, effectively wiping the device’s ties to the original owner and enabling its reuse or resale on secondary markets.

What Makes This Phishing-as-a-Service Model Particularly Dangerous

The scam leverages the inherent trust users place in official support channels, particularly when distressed over a stolen device. Researchers noted that the AI voices are highly convincing, using natural speech patterns and Apple-branded terminology to reduce suspicion. Victims, often anxious to recover their data or device, may comply without verifying the caller’s authenticity. Unlike traditional phishing emails, this method bypasses visual cues and relies on auditory deception, making it harder to detect in real time.

This operation represents a shift toward scalable, low-effort cybercrime tools that democratize sophisticated attacks. By offering AI voice agents as a rental service, the platform enables even technically unskilled individuals to launch convincing social engineering campaigns. The use of AI also allows for rapid scaling, multilingual outreach, and adaptive scripts based on victim responses. Security experts warn that such services could expand beyond Apple devices to target other brands and authentication systems.

Frequently Asked Questions

How do attackers use the stolen passcodes and 2FA codes? Once obtained, the passcode and 2FA codes allow attackers to disable Activation Lock on Apple devices, removing them from the original owner’s i Cloud account and enabling full reactivation for resale or personal use.

Why are AI voice calls more effective than traditional phishing methods? AI voice calls exploit urgency and trust in real-time conversation, lack visible red flags like suspicious links, and can adapt dynamically to victim responses, increasing the likelihood of success compared to static phishing emails.