He Stole Hundreds of iPhones and Looted People’s Life Savings. He Told Us How.

RUSH CITY, Minn.—Before the guards let you through the barbed-wire fences and steel doors at this Minnesota Correctional Facility, you have to leave your phone in a locker. Not a total inconvenience when you’re there to visit a prolific iPhone thief.

I wasn’t worried that Aaron Johnson would steal my iPhone, though. I came to find out how he’d steal it.

“I’m already serving time. I just feel like I should try to be on the other end of things and try to help people,” Johnson, 26 years old, told me in an interview we filmed inside the high-security prison where he’s expected to spend the next several years.

For the past year, my colleague Nicole Nguyen and I have investigated a nationwide spate of thefts, where thieves watch iPhone owners tap their passcodes, then steal their targets’ phones—and upend their financial and digital lives.

Johnson, along with a crew of others, operated in Minneapolis for at least a year during 2021 and 2022. In and around bars at night, he would befriend young people, slyly learn their passcodes and take their phones. Using that code, he’d lock victims out of their Apple accounts and loot thousands of dollars from their bank apps. Finally, he’d sell the phones themselves.

It was an elaborate, opportunistic scheme that exploited the Apple ecosystem and targeted trusting iPhone owners who figured a stolen phone was just a stolen phone.

Last week, Apple announced Stolen Device Protection, a feature that likely will protect against these passcode-assisted crimes.

Yet even when you install the software, due in iOS 17.3, there will be loopholes. The biggest loophole? Us. By hearing how Johnson did what he did, we can learn how to better secure the devices that hold so much of our lives.

How he got started

Johnson isn’t a sophisticated cybercriminal. He said he got his start pickpocketing on the streets of Minneapolis. “I was homeless,” he said. “Started having kids and needed money. I couldn’t really find a job. So that’s just what I did.”

Soon he realised the phones he was nabbing could be worth a lot more—if only he had a way to get inside them. Johnson said no one taught him the passcode trick, he just stayed up late one night fiddling with a phone and figured out how to use the passcode to unlock a bounty of protected services.

“That passcode is the devil,” he said. “It could be God sometimes—or it could be the devil.”

According to the Minneapolis Police Department’s arrest warrant, Johnson and the other 11 members of the enterprise allegedly accumulated nearly $300,000. According to him, it was likely more.

“I had a rush for large amounts at a time,” he said. “I just got too carried away.”

In March, Johnson, who had prior robbery and theft convictions, pleaded guilty to racketeering and was sentenced to 94 months. He told the judge he was sorry for what he did.

How he did it

Here’s how the nightly operation would go down, according to interviews with Johnson, law-enforcement officials and some of the victims:

Pinpoint the victim. Dimly lit and full of people, bars became his ideal location. College-age men became his ideal target. “They’re already drunk and don’t know what’s going on for real,” Johnson said. Women, he said, tended to be more guarded and alert to suspicious behaviour.

Get the passcode. Friendly and energetic, that’s how victims described Johnson. Some told me he approached them offering drugs. Others said Johnson would tell them he was a rapper and wanted to add them on Snapchat. After talking for a bit, they would hand over the phone to Johnson, thinking he’d just input his info and hand it right back.

“I say, ‘Hey, your phone is locked. What’s the passcode?’ They say, ‘2-3-4-5-6,’ or something. And then I just remember it,” Johnson described. Sometimes he would record people typing their passcodes.

Once the phone was in his hand, he’d leave with it or pass it to someone else in the crew.

Lock them out—fast. Within minutes of taking the iPhones, Johnson was in the Settings menu, changing the Apple ID password. He’d then use the new password to turn off Find My iPhone so victims couldn’t log in on some other phone or computer to remotely locate—and even erase—the stolen device.

Johnson was changing passwords fast—“faster than you could say supercalifragilisticexpialidocious,” he said. “You gotta beat the mice to the cheese.”

Take the money. Johnson said he would then enrol his face in Face ID because “when you got your face on there, you got the key to everything.” The biometric authentication gave Johnson quick access to passwords saved in iCloud Keychain.

Savings, checking, cryptocurrency apps—he was looking to transfer large sums of money out. And if he had trouble getting into those money apps, he’d look for extra information, such as Social Security numbers, in the Notes and Photos apps.

By the morning, he’d have the money transferred. That’s when he’d head to stores to buy stuff using Apple Pay. He’d also use the stolen Apple devices to buy more Apple devices, most often $1,200 iPad Pro models, to sell for cash.

Sell the phones. Finally, he’d erase the phone and sell it to Zhongshuang “Brandon” Su who, according to his arrest warrant, sold them overseas.

While Johnson did steal some Android phones, he went after iPhones because of their higher resale value. At bars, he’d scope out the scene—looking for iPhone Pro models with their telltale trio of cameras. He said Pro Max with a terabyte of storage could get him $900. Su also bought Johnson’s purchased iPads.

Su pleaded guilty to receiving stolen property and was sentenced to 120 days at an adult corrections facility in Hennepin County, Minn. Neither Su nor his lawyer responded to requests for comment.

On a good weekend, Johnson said, he was selling up to 30 iPhones and iPads to Su and making around $20,000—not including money he’d taken from victims’ bank apps, Apple Pay and more.

How you can prevent it

A week after my trip to Minnesota, Apple announced Stolen Device Protection. The security setting will likely foil most of Johnson’s tricks, but it won’t be turned on automatically.

If you don’t turn it on, you’re as vulnerable as ever. Switching it on adds a line of defence to your phone when away from familiar locations such as home or work.

To change the Apple ID password, a thief would need Face ID or Touch ID biometric scans—that is, your face or your finger. The passcode alone won’t work. And the process has a built-in hourlong delay, followed by another biometric scan. This same slow process is also required for adding a new Face ID and disabling Find my iPhone.

Some functions, such as accessing saved passwords in iCloud Keychain or erasing the iPhone, are available without the delay but still require Face ID or Touch ID.

A criminal might still be motivated to kidnap a person with lots of money, then slowly break through these layers of security. However, the protections will likely dissuade thieves who just want to grab phones and flee the scene.

So what loopholes remain? A thief who gets the passcode could still buy things with Apple Pay. And any app that isn’t protected by an additional password or PIN—like your email, Venmo, PayPal and more—is also vulnerable.

That’s why you should also:

Add a distinct passcode to money apps, like Venmo and Cash App.
Delete any notes or photos that include personal information such as passwords or Social Security numbers. Store that stuff in a secure note inside a third-party password manager, such as Dashlane or 1Password.
Create a stronger iPhone passcode—one that uses letters and numbers.

The most obvious is Johnson’s advice: Watch your surroundings and don’t give your passcode out.

If this crime has taught us anything, it’s that a single device now contains access to our entire lives—our memories, our money and more. It’s on us to protect them.

—Nicole Nguyen contributed to this article.

Reporting season has once again reminded investors that a strong profit does not guarantee a rising share price, and a large loss does not always trigger a sell-off. What matters most is how each result compares with expectations and, increasingly, what management says about the year ahead. During the August 2026 season, companies offering credible turnarounds or unexpectedly strong guidance were rewarded handsomely, while those flagging weaker margins, slowing demand or greater uncertainty were punished.

The following ranking draws on Morningstar’s review of 164 ASX-listed companies and measures each company’s share-price movement on the day it reported. This captures the market’s immediate response to the earnings announcement, before subsequent economic developments, dividends and company-specific news cloud the picture. Here are the five biggest winners, and the five hardest-hit losers, of the season so far.

The five winners

1. Bapcor (ASX:BAP): +41.0%

Bapcor delivered reporting season’s largest relief rally after presenting early evidence that its troubled automotive-parts business was stabilising. Although underlying revenue fell 1.8% to $1.92 billion and underlying NPAT collapsed 85% to $10.8 million, underlying EBITDA of $152.5 million exceeded guidance.

More importantly, working-capital initiatives released $68.5 million in the second half, lifting cash conversion to 109.4% and reducing net debt by 63% to $135 million. The statutory loss was $431.6 million, largely because of non-cash impairments. Investors focused on improving operational momentum, stronger liquidity and management’s expectation of modest FY27 revenue growth.

2. Zip Co (ASX:ZIP): +18.2%

Zip comfortably surpassed its FY26 targets, sending the buy-now-pay-later provider’s shares sharply higher. Transaction volume rose 23% to $16.7 billion, while cash earnings before tax, depreciation and amortisation jumped 58% to a record $268.9 million. Statutory profit climbed 46% to $116.4 million, and the cash operating margin expanded by 4.2 percentage points to 20%.

The strongest signal was guidance for FY27 cash earnings of $340 million—around 26% growth and above analysts’ forecasts. US transaction volume increased 42.5% and now represents three-quarters of group volume, offsetting weaker customer activity in Australia.

3. CSL (ASX:CSL): +17.3%

CSL’s result was hardly spectacular in isolation, but it cleared a market bar that had fallen dramatically following earlier downgrades and restructuring announcements. Underlying NPATA was US$3.1 billion, down 2% in constant-currency terms, while operating cash flow reached US$3.51 billion.

CSL maintained its full-year dividend at US$2.92 per share and completed a A$1 billion buyback. The real catalyst was FY27 guidance for approximately 5% underlying profit growth, compared with market expectations closer to 2%. After an extended period of earnings disappointments, investors interpreted the outlook as evidence that CSL’s core plasma business was approaching a sustainable recovery.

4. Judo Capital (ASX:JDO): +16.9%

Judo Capital demonstrated strong operating leverage as its specialist business-lending franchise expanded. Full-year profit before tax rose 34% to $168.1 million, while pre-provision profit increased 42%. Gross loans and advances grew 18% to $14.7 billion, reaching the top of the bank’s guidance range and comfortably exceeding broader system growth.

Deposits increased 24% to $12.2 billion, return on equity improved by 1.1 percentage points to 6.4%, and earnings per share rose 29% to 9.9 cents. Reaffirmation of the FY27 outlook gave investors confidence that loan growth could continue without sacrificing margins or credit quality.

5. Super Retail Group (ASX:SUL): +15.8%

The owner of Supercheap Auto, rebel, BCF and Macpac reported record sales of $4.2 billion, up 3.2%, despite cautious discretionary spending. Profitability went backwards: normalised profit before tax fell 7% to $306 million and normalised NPAT declined 2.8% to $226 million as transformation spending weighed on margins. Nevertheless, the result exceeded subdued expectations, online sales grew 5.3% and membership across the group’s loyalty programs reached 13.1 million. Investors were also encouraged by positive early FY27 trading, stable gross margins and continued market-share gains. A fully franked 33-cent final dividend added to the appeal.

The five losers

1. Hansen Technologies (ASX:HSN): –21.2%

Hansen’s historic result met expectations, but investors recoiled from its outlook. The utility and communications software provider achieved an underlying EBITDA margin of 31%, exceeding its 30% target, while generating strong cash flow. However, management designated FY27 an “investment and transition year”, signalling a roughly five-percentage-point margin contraction as spending on products, sales capabilities and organisational changes increased.

Revenue had already been broadly flat, leaving investors concerned that the investment program would depress earnings before new growth appeared. Leadership changes, including the chief executive’s departure, added uncertainty. Management expects revenue growth and margins above 30% to return in FY28, but the market was unwilling to wait.

2. Life360 (ASX:360): –19.4%

Life360’s headline growth was impressive: quarterly revenue rose 38% to US$159 million, subscription revenue increased 31%, and adjusted EBITDA climbed 53% to US$31.1 million. Monthly active users reached 102.4 million and paying circles grew 27% to 3.2 million. The sell-off reflected expectations rather than a collapsing business.

Net income fell 18%, the net margin contracted from 6% to 3%, hardware shipments dropped 18%, and full-year EBITDA guidance was merely maintained. After a strong valuation run, investors wanted a larger upgrade and clearer evidence that heavy investment in advertising, international expansion and artificial intelligence would generate additional earnings.

3. PEXA Group (ASX:PXA): –17.0%

PEXA reported a 7% increase in continuing-operations revenue and 12% EBITDA growth to $152 million, accompanied by a two-percentage-point margin expansion. Free cash flow increased 39%, suggesting the core Australian electronic-conveyancing platform remained highly profitable. Investors instead concentrated on management’s warning that property-transfer volumes could decline, alongside regulatory uncertainty surrounding the fees PEXA can charge.

The company is also continuing to invest heavily in its loss-making international expansion. Morningstar considered the market reaction excessive, arguing that structural transfer-volume assumptions had not materially changed, but the combination of softer near-term activity and regulatory risk overwhelmed the respectable headline numbers.

4. SEEK (ASX:SEK): –14.3%

SEEK produced solid FY26 figures, including 10% revenue growth to $1.20 billion, a 15% rise in EBITDA and 28% growth in adjusted earnings per share. It also lifted its fully franked annual dividend by 13% to a record 52 cents. Those achievements were overshadowed by falling paid job-ad volumes and cautious FY27 assumptions.

The statutory accounts included a $201 million loss from the SEEK Growth Fund and $377 million of significant items, making the headline result considerably less attractive. Investors were particularly concerned that economic weakness could limit volumes while the company continued investing in platform integration and artificial-intelligence products.

5. JB Hi-Fi (ASX:JBH): –12.3%

JB Hi-Fi’s full-year result was broadly respectable, with group sales rising 5% to $11.1 billion and underlying earnings per share increasing 6% to $4.48. The damage came from its current-trading update. Australian sales were almost flat during the June quarter and deteriorated further in July, while earnings in the core Australian electronics business fell 3.6%.

Housing-related categories were particularly weak as higher living costs and interest rates constrained household budgets. With JB Hi-Fi entering the season on a demanding valuation, an in-line historic result was not sufficient: the loss of sales momentum prompted investors to rapidly reduce their expectations for FY27.

Overall, the season showed that share prices react less to whether profits rose or fell than to the gap between results and expectations. Bapcor was rewarded for being less troubled than feared, while several fundamentally profitable companies were punished because their outlooks failed to justify elevated valuations.