Private Pictures on Cloud have been Compromised

Lesson learned. I hope your daughter protects her new Pass Code and Apple ID password from everybody except her parents.

As much as possible, she should unlock her phone only with her face or fingerprint, as appropriate. In order to avoid having to key in her Pass Code in the presence of these so-called friends, she should get in the habit of unlocking the phone by Pass Code when she gets out of bed every morning, which should keep the one week refresh timer from ever showing up while she is with them.

As to the photos, we can only hope that there was nothing truly sensitive in those images because there is not much that can be done to trace their path once (or if) they left her phone.

One more thing you should consider doing is to deprive Camera and Photos of access to Location Services, especially if your daughter ever posts photos to social media. Countless burglaries occur because someone can't resist the urge to post holiday photos while still on holiday after posting Christmas lights photos that expose the home address. Shades of "Home Alone".

In order to get into the account, these boys would also have needed access to your daughter's phone and her finger, face or Lock Code, as appropriate, in order to see the pop-up request, approve it, receive the 6-digit code and see it on her phone.

Is it really possible that your daughter allowed all of this to happen? Or are these boys just trying to gaslight your daughter?