18

I'll be travelling to Mongolia, and I've heard there's a non-trivial chance of theft. I'll be taking two Apple iPhones with me, and I'm not too concerned about the theft of the devices themselves, as that's a bounded cost.

Do I need to take precautions against identity theft, and if so, what personally identifiable information should I delete from my smartphone and email before travelling?

The only personally identifiable information on my email and smartphone relate to me as an Australian - I have worked for a year in the US, but that was prior to me setting up the only email account set up on my phones, and buying my iPhones.

Related questions: Photocopies of important documents stolen (more about what to do after theft has occurred, not beforehand), and What harm can be done with a copy of one's passport? (specific to passports). Wikivoyage has a section on identity theft, but it's more or less only about passports.

  • 8
    I don't see anything that makes this Q Mongolia-specific, so could you edit it to make it a general question? – mts Jul 2 '16 at 16:30
  • It took the FBI several weeks to find a person that could hack the iPhone in under 2 mins, there are apps and tools out now thanks to this that make it a one and two click operation to gain accessto an iPhone. Just take a dummy phone a cheap $10.00 touch screen while your on holiday so no personal info can be stolen. – user46893 Jul 2 '16 at 23:02
  • What about source of your claim? (One click app for unlocking an iphone ios9+) – Kyslik Jul 3 '16 at 0:32
  • 1
    @mts how does it look now? – Andrew Grimm Jul 3 '16 at 3:27
37

If you have a sufficiently modern iPhone (eg. anything that runs iOS 9 would be fine), then enable a passcode, set "Require Passcode" to "Immediately" (so you have to enter it every time you open the phone) or something short. The phone's memory is encrypted using a key derived from the passcode. No passcode, no personally identifiable data.

If you do this, then the chance of identity theft due to a stolen phone is effectively zero.

  • 17
    This answer is correct, but assumes the OP won't be in the situation of being forced to unlock the device (whether by police, immigration authorities, plain old criminals, etc.). If that's a concern then the question has a lot more interesting depth to it. – R.. Jul 2 '16 at 18:26
  • 2
    @R.. I'm not that worried about that scenario, as at least I'd know about it happening. (Unless someone's snooping on me using the iPhone) – Andrew Grimm Jul 3 '16 at 3:55
  • 2
    You should also disable notification preview, as the iphone reveals a few lines of text. It is useful especially for messages – code ninja Jul 3 '16 at 16:08
  • 4
    @KeithM: The easiest way to mitigate that risk is to set the "Erase Data" option which erases all data on the device after 10 failed passcode attempts. The second easiest way is to use a longer alphanumeric passcode instead of a 4- or 6-digit one. – Greg Hewgill Jul 4 '16 at 2:18
  • 3
    @KeithM: the PIN code used in iOS and Android is very good. You have an exponential cool-down time between attempts (starting from the 5th) - that is it takes longer and longer between attempts to use the PIN. After some time you will have to wait a week between attempts. On top of this you can set the iPhone to erase after 10 missed attempts. The encryption behind this scheme is very good too. – WoJ Jul 4 '16 at 6:44
20

None, as long as you lock your phone with a password. It took the FBI several weeks of efforts to crack an iPhone belonging to the San Bernardino mass shooter, so a random low-level thief won't have the skills or tools to access your encrypted information.

I would worry more about information stolen on your laptop, although that also can be mitigated by encrypting your drive with VeraCrypt or a similar piece of software.

  • 7
    I use BitLocker that is shipped with Windows. – Nean Der Thal Jul 2 '16 at 8:47
  • 3
    @HeidelBerGensis Which again unless you're the government (whom definitely has BitLocker backdoors) no one can access it. – Insane Jul 3 '16 at 2:14
  • 5
    @Insane There are no backdoors in Bitlocker. (The FBI has asked and been rebuffed.) – HopelessN00b Jul 3 '16 at 2:25
  • 6
    @HopelessN00b Crap the FBI said they didn't? Guess they don't! – Insane Jul 3 '16 at 2:27
  • 4
    @Insane No, the Microsoft engineers told them shove it. – HopelessN00b Jul 3 '16 at 2:27
8

Unless you need that specific device, I would get a throw-away device to carry in questionable situations. You can get decent Android devices for under $100 US.

  • 2
    Using the specific device is more convenient, so that I'm taking photos on the same device as usual. – Andrew Grimm Jul 3 '16 at 3:35
8

Most people that target identify theft are not looking at your cellular phone; they are looking at things that can be used to impersonate you - so your id card, passport, etc.

People stealing phones are looking at reselling them for a quick buck. So, if you put a passcode on your phone, it makes it less of a target for being sold on. iPhones in particular have robust security (as detailed by Greg).

I would not be worried about my identity being stolen via my phone.

6

Everyone has given good advice about the phone and that it will almost undoubtedly be safe if you put a password on it (rather than a short PIN). The only issue that I see is to ensure that access to your email service is encrypted. Almost all are these days, so it's only a concern if you access mail without using SSL.

You will see this under Advanced Settings in account setup where it should have "Use SSL" selected.

  • How is this going to prevent identity theft? – Burhan Khalid Jul 4 '16 at 8:28
  • @BurhanKhalid If you're downloading and sending email over an unencrypted connection, you're likely to be providing access to PII – Berwyn Jul 4 '16 at 8:33
  • 1
    @BurhanKhalid Ensuring your email connection is protected by SSL prevents someone intercepting your email connection, learning your password and reading all your previous email. Within your email is likely to be other information about your identity, including name, birth date, address etc, sent in previous mails. Having access to someone's emails is a rich source of information useful for identity theft. Also you could use for some forms of 2FA also useful for identity theft in some cases. – Berwyn Jul 4 '16 at 8:40
  • 2
    @BurhanKhalid You cannot spoof an SSL connection without installing a root CA on the phone. If an attacker can do that, they can do anything. – Berwyn Jul 4 '16 at 8:46
  • 1
    @BurhanKhalid GMail in Chrome has certificate pinning, although if you go to the trouble of installing a root certificate with global signing privileges, it will be ignored for the reasons you cite (app testing and system administrators imposing policy on employees). If a Chinese proxy asked me to install a root certificate, I'd probably decline ;) – Calchas Jul 4 '16 at 23:17
2

The only other recommendation I have is to delete (uninstall/remove) any banking related apps on the phone before your travel, for 3 reasons:

  1. It is not too difficult to retrieve logs generated by apps installed on a phone and I wouldn't completely rely on the banks that they have secured their apps in all possible ways
  2. You are likely to access internet via public WiFi
  3. If for any reason you need the apps, you can always re-install them
  • The question is about identity theft, not general phone security. Why stop at banking apps? Why not delete social network and email apps? – Burhan Khalid Jul 4 '16 at 8:30
  • @BurhanKhalid my bank account is more important to me than my privacy! – Rocky Inde Jun 18 '18 at 12:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.