How to prevent further fraudulent activities on a stolen iPhone with compromised passcode?

You must assume that ALL of the data on the device has already been compromised and take appropriate actions.

If you haven't already done so, you need to change ALL of your passwords on all of the sites and services you use.

You need to change your Apple account password and remove the phone as a trusted device for 2 factor authentication.

Your problem goes way beyond what we or Apple can do for you.

As KiltedTim says, if you gave the thieves your passcode, you must assume that they have ransacked all of the data on your iPhone – including sensitive data. You will need to secure every account associated with that phone – with particular attention to potential fraud involving bank, credit card, brokerage, and shopping accounts.

One of the accounts that you need to secure right away is your Apple Account, if you have not already done so.

If you think your Apple Account has been compromised - Apple Support

That won't keep the thieves from using the data they got directly from the phone. It's just that it would be a really bad idea for them to have ongoing access to your Apple Account going forward.

Audemus wrote:

Thank you. Should I sign the phone out of my Apple ID. To be clear, I have changed my Apple ID password and my phone is no longer in my trusted device list.

My thoughts are that you need to secure your Apple Account to protect it against future use by the thieves. It sounds like, from what you are saying now, that you gave the thieves your Apple Account password, as well as your passcode.

The passcode would have let them get into your device to ransack data on the device.

The Apple Account credentials would have let them remove your phone from your list of devices, getting rid of Activation Lock, so they could "make your phone their own." It also would have let them ransack data in iCloud. Until you secure that account (with a password they do not know and cannot easily guess) and make sure that there are no unfamiliar / unauthorized devices associated with it, you are still in danger going forward.

What you want to do is to recover your Apple Account as yours, and yours alone.

Audemus wrote:

They don’t have my Apple password and I have changed it, the phone has also been removed from , my trusted devices but it’s still listed as a device under my Account Account, official sources advise not to remove the device but I’m really not sure whether this is the right thing to do. I’m now worried that any future updates (example photos , notes) will get updated on that phone if I don’t remove the device from my account ?

If they don't have your Apple Account password, then I suspect they will NOT be able to remove Activation Lock from the phone. It will remain unless YOU clear it by removing the phone from the list of devices associated with your account.

If you do that, the phone may remain visible in Find My for up to 30 days, but you will have removed the Activation Lock and it will be "payday" for the thieves.

You indicated that Lost Mode is pending and that you have an Erase pending.

• As long as the phone is offline, it won't learn about either, but it won't be getting any sort of synchronized data updates, either. No Internet connection, no synchronization.
• If they let it back online, it would be able to resume synchronization, except for the pesky little detail that it will also learn of the Lost Mode and Erase requests, and will lock and wipe itself.

For what it's worth, you may also be interested in these sites:

https://www.usa.gov/identity-theft

https://www.identitytheft.gov

https://consumer.ftc.gov/identity-theft-and-online-security/identity-theft

The second one, unfortunately, has a notice saying that its services are not available at this time due to the U.S. Government shutdown.

You can't do anything with it. The thief has already removed the activation lock on the device.

Why did you post two threads on the very same topic? It's not helpful to you or the community to duplicate threads --> Stolen phone and credentials, concerned L… - Apple Community

You can't delete the thread, but you can edit it for up to 15 minutes after it is posted.