Why is it seemingly impossible to stop phone thieves?

Even if you have never had your smartphone stolen, you probably know someone who has. In London, 80,000 phones were stolen last year alone. And as victims of phone theft know, while the loss of a pricey gadget can sting, the dreary administrative slog in replacing a device that runs your entire life can, in some ways, be worse. So why can’t we stop phone thieves – and is there a better way to protect your personal data?

The answer is partly down to the numerous ways that criminals profit from stolen phones, but it is also about technology firms prioritising usability over security and international governments failing to arrive at a global solution. In short, it’s complicated.

Some victims place the blame with the police for failing to catch phone thieves. When Nav Dugmore from Wolverhampton, UK, travelled to London for the first time, she had her iPhone snatched seconds after leaving Euston train station, a major transport hub. “It traumatised me, if I’m honest,” she says. “There needs to be something else put in place to stop them being able to use your phone, and I think the police need to be doing more.”

London’s Metropolitan Police told her that several other thefts had happened at the same spot in the previous hour and admitted there was “no chance” of recovery. Dugmore had the phone’s face-recognition security setting turned on, but the device was unlocked when it was grabbed and the thief quickly spent £300 in various shops around London. By far the biggest blow was the loss of photos of her three children growing up, she says, which weren’t backed up.

When a phone like Dugmore’s is stolen, it enters a conveyor belt of crime, with multiple possible destinations. The simplest route is the thief simply selling the handset on, often to be resold in another country. Phones can be sold for parts to unscrupulous repair shops, too. Daniel Green, an inspector at the City of London Police, says phone snatchers have links to gangs that export the devices, essentially smuggling them out the same way as drugs are smuggled in. “What we’ve found suggests boxes and boxes of phones going out [of the country],” he says.

Then there are more involved scams, like removing the SIM card that identifies a phone to the network and placing it into another handset. This allows criminals to read text messages destined for the victim and can get them access to email and websites that use two-factor authentication. This can be combatted by setting up a PIN for your SIM card, but this must be done before the phone is stolen.

The most valuable phone for thieves to target is one with no security protections, but even setting a PIN on your handset won’t necessarily protect you, says James O’Sullivan, who runs an app called Nuke designed to help people in the aftermath of their phone being stolen. Thieves may simply look over your shoulder to see your PIN, or use more devious tricks. For instance, activating an iPhone’s Emergency SOS feature and then cancelling it will temporarily disable access via face or fingerprint recognition, forcing you to input your PIN the next time you unlock it. A clever thief can offer to take a photo for you, surreptitiously pull this trick, then snoop when you enter your PIN after they hand back the phone.

With unlocked access, criminal options become even more sophisticated. Thieves can steal money from online banking apps or cryptocurrency wallets, then message the victim’s friends and family to scam them into sending emergency funds. They can even post nefarious links on social media accounts to phish others into providing their logins or private data.

So what can be done? The UK government at least recognises that there is a problem. It launched a crackdown late last year, promising to pressurise smartphone manufacturers to permanently disable stolen phones. It also pledged to conduct an investigation to learn more about the people who steal phones, where the devices end up and how to stop the problem.

In theory, the technology already exists to disable stolen phones. Each device carries a unique IMEI code and those reported stolen can be blocked from cell phone networks, which already happens on a per-country basis in places including the UK, Canada and the US. But a phone blocked in this way can still access the internet through Wi-Fi connections. The Met Police has long urged technology firms to build on this and also block access to cloud services from those handsets, such as data backup and photo storage, which would reduce their functionality and make them less attractive to thieves. So far, Apple and Google have declined to do so.

Even this wouldn’t help if such restrictions continue to operate on a per-country basis, as is the case with IMEI blocks now, as criminals can simply send phones to a country where they aren’t blocked. Green says he would like to see manufacturers create a permanent kill switch for devices, to completely remove the incentive for criminals to take phones. “I don’t know whether it’s just not a problem for them,” he says. “More pressure needs to be put on them. We’re trying to pick up the pieces on our end and it’s very, very difficult.”

Jordan Hare, a former police digital forensics expert who now works at private security firm S-RM, says phones are already equipped with security features that should keep even the most determined crooks at bay. For example, some phones automatically lock if they detect a sudden jerking movement, like being snatched by a thief.

The problem is that many of these options are turned off by default – something Hare suspects is done to make life as simple and seamless as possible for users. “An opt-in for these features actually doesn’t help the general consumer because they don’t necessarily know they’re there,” he says. “Whereas an opt-out scheme, having them on by default, having better information provided when you first set up your phone about ‘this setting is on, this is what it does, this is why you shouldn’t turn it off’, for example, actually puts measures in place ahead of a phone being stolen.”

Meanwhile, other security features that sound promising, like the ability to track the current location of your phone from a web browser, simply fail to make a difference in the real world. If a phone is tracked to a large block of flats, there is little police officers can do without further information because it isn’t possible to get such a wide-ranging search warrant.

That was certainly Dugmore’s experience with her stolen iPhone. “The last location was about 10 miles away from where my phone was stolen,” she says. “The police did say ‘there’s no chance of you getting that phone back’.” When asked about the incident, the Metropolitan Police told New Scientist: “Unfortunately the investigation couldn’t be progressed further due to a lack of CCTV in the area. We recognise the victim’s frustration.”

Most major smartphone venders didn’t respond to a request for comment by New Scientist, with Samsung, Xiaomi and Google failing to reply. Apple did respond, however.

“We have been working on this issue from a hardware, software and customer-support standpoint for more than the last decade,” says an Apple spokesperson. “We have made and continue to make significant investments to create industry-leading tools and features that put control in the hands of our users in the event of theft.” The spokesperson declined to explain why some security options aren’t turned on by default.

Ultimately, the only way to prevent smartphone theft – other than being careful whenever you use your device in public – is for manufacturers to make it not worth criminal’s while. They have control over the hardware and software, and could bring in unhackable features that completely lock down a phone, its apps and its spare parts from abuse or resale. But O’Sullivan says it just doesn’t seem to be a priority. “If I’m brutally honest, it’s probably not their biggest thing, because stolen phones are reasonably good business for people that are selling new phones.”