In 2026, crypto thieves in London are utilizing a high-tech version of 'shoulder surfing' to observe victims' iPhone passcodes in public spaces before physically stealing the device to bypass biometric security. By obtaining the device passcode, attackers can reset Apple ID passwords, disable 'Find My' tracking, and gain unrestricted access to mobile exchange apps and hot wallets. This specific attack vector bypasses standard two-factor authentication (2FA) because the stolen phone itself usually acts as the 2FA recipient, allowing criminals to drain thousands of dollars in crypto assets within minutes.
A recent case involving victim Magnus Ahmad highlights the devastating efficiency of this tactic. After being befriended by strangers outside a London bar, Ahmad’s iPhone was stolen; because the thieves had already observed his passcode, they were able to drain $14,000 in crypto, access his traditional bank accounts, and even remotely lock his laptop to prevent him from stopping the transfers. This trend demonstrates that for mobile-first crypto users, physical security and environmental awareness are now just as critical as digital encryption and private key management.
For US-based investors and travelers, these incidents underscore a significant vulnerability in the mobile crypto ecosystem. While US and UK regulators have focused on platform-level security and anti-money laundering (AML) protocols throughout 2026, street-level physical theft remains a largely unaddressed risk by software developers. Security experts recommend that users enable 'Stolen Device Protection' features, utilize hardware security keys that are kept separate from the phone, and avoid entering passcodes in crowded or unsecure public locations.
The persistence of these specialized muggings is driving a shift in market behavior toward cold storage and multi-signature (multisig) setups. As London struggles with a surge in crypto-related physical thefts, there is growing pressure on hardware manufacturers like Apple and wallet providers like MetaMask to decouple device passcodes from financial app access. Investors should watch for new firmware updates or app-level 'panic switches' designed to brick financial access if a device is reported stolen via a secondary emergency channel.