Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Old news. There's a whole thread on this. You'd have to take the watch off an unconscious person for this to really work. I doubt a pickpocket could pull it off. So all things considered it's pretty safe.

Agree.
 
Even if they got you watch there is little to no information on it.

Possibly Apple Pay data, though.

Yes this. Most of your private contacts will be on there depending on how you use the watch, which could be a concern depending on who you are and who you know, and there could be sensitive photos on there for anyone. Perhaps iCloud information too? Maybe confidential Health data? And most importantly why anyone would want to try this is primarily to use the watch for Pay.

Since Pay is supposed to be secure, no ID will be asked for by merchants, it doesn't require a signature, and will be accepted without question. Of course this goes to the whole idea that the original owner would literally have to be unconscious or immobile for this to happen, and it would only be good for as long as the original owner is prevented from canceling all of their financial information. So the scenario would be something like, a gang of Pay thieves target wealthy Watch owners, and slip them a drug at a bar or club, knocking them out for 8 or more hours, allowing them to transfer the watch and go on a shopping spree. Also, if they've one that, they could also take the iPhone, use the owners Touch ID with his fingerprint, and turn that off, thus gaining access to everything from that person's mobile life.

Obviously this is an extreme situation, not likely to happen to most people ... but it absolutely could happen given this particular flaw.
 
Last edited:
Yes this. Most of your private contacts will be on there depending on how you use the watch, which could be a concern depending on who you are and who you know, and there could be sensitive photos on there for anyone. Perhaps iCloud information too? And most importantly why anyone would want to try this is primarily to use the watch for Pay. Since Pay is supposed to be secure, no ID will be asked for by merchants, it doesn't require a signature, and will be accepted without question. Of course this goes to the whole idea that the original owner would literally have to be unconscious or immobile for this to happen, and it would only be good for as long as the original owner is prevented from canceling all of their financial information. So the scenario would be something like, a gang of Pay thieves target wealthy Watch owners, and slip them a drug at a bar or club, knocking them out for 8 or more hours, allowing them to transfer the watch and go on a shopping spree. Also, if they've one that, they could also take the iPhone, use the owners Touch ID with his fingerprint, and turn that off, thus gaining access to everything from that person's mobile life.

Obviously this is an extreme situation, not likely to happen to most people ... but it absolutely could happen given this particular flaw.

AW owners wealthy? :p

Glad I am back to my Rolex!
 
So the scenario would be something like, a gang of Pay thieves target wealthy Watch owners, and slip them a drug at a bar or club, knocking them out for 8 or more hours, allowing them to transfer the watch and go on a shopping spree. Also, if they've one that, they could also take the iPhone, use the owners Touch ID with his fingerprint, and turn that off, thus gaining access to everything from that person's mobile life.

Obviously this is an extreme situation, not likely to happen to most people ... but it absolutely could happen given this particular flaw.

They still would need the Apple ID password, and phone pin. Or else, all they could do was use applepay, because the phone would autolock. Where ever they would go, they would be on camera when using it, so again not the most ideal situation for a thief.
 
I just don't see how this going to work unless the first person is willing or unconscious. Once the watch is transferred they can't change the PIN without knowing the old one. This is like the reports of how to fake the touchID sensor by faking the fingerprint. Yes, a theoretical flaw but unlikely to happen in real-life.
 
They still would need the Apple ID password, and phone pin. Or else, all they could do was use applepay, because the phone would autolock. Where ever they would go, they would be on camera when using it, so again not the most ideal situation for a thief.

Oh you're right. I was thinking you could access Touch ID and security settings with a fingerprint. You can change the auto lock to 5 minutes though without a password, so that gives someone a lot more time to keep the phone active after the initial unlock to access everything else in the phone that doesn't require Touch ID or the password. If they paid enough attention to it they could keep it perpetually unlocked.

As for the security camera thing ... if there's really an Watch crime ring, drugging it's victims to steal their active watches, they're going to find an effective way to disguise themselves. And thinking about the iPhone, is there anything stopping them from drugging someone and stealing their Touch ID unlocked iPhone, and go on an Pay spending spree now as long as they keep the phone active? I don't have Pay on my 5S, can it be used without additional authentication? Or do you always have to acknowledge an Pay transaction with TouchID or passcode?

But you're right ... this isn't the most ideal situation for a thief.
 
I just don't see how this going to work unless the first person is willing or unconscious. Once the watch is transferred they can't change the PIN without knowing the old one. This is like the reports of how to fake the touchID sensor by faking the fingerprint. Yes, a theoretical flaw but unlikely to happen in real-life.
Yes that's the point, the victim is drugged, or kidnapped. They don't need a passcode just to use the watch, once it's been activated on the victim's arm. Just transfer it to a new arm while active per the video, and tap the button for Pay transactions. The right victim could result in tens of thousands of credit card purchases. So it's actually very different from the fake TouchID sensor.
 
Last edited:
download.jpeg
 
I don't have Pay on my 5S, can it be used without additional authentication? Or do you always have to acknowledge an Pay transaction with TouchID or passcode?

Apple Pay on the phone always requires fingerprint for each transaction. I don't think you can perform a transaction with a passcode, but I'm not a 100% sure about that point.
 
The right victim could result in tens of thousands of credit card purchases.

Which the victim isn't responsible for anyway. Really no different from someone stealing your wallet and going on a spending spree. Customers are never responsible for fraudulent charges so worrying about such a thing is pointless.
 
The perpetrator would only get a 'few hours' according to some people before the battery dies and they will have to take it off to charge!
 
Which the victim isn't responsible for anyway. Really no different from someone stealing your wallet and going on a spending spree. Customers are never responsible for fraudulent charges so worrying about such a thing is pointless.
I had a girlfriend one time who was irritated by the person driving behind us following too close, and she said "let them hit us, it will be their fault".

Who's responsible for an accident isn't really the point. I think I'd rather not have the accident.

I was the first person to post on this thread discrediting the assertion of the OP. I'm definitely not worried about this, nevertheless, it's interesting to discuss. The only way this works is with some kind of elaborate Watch crime ring, which somehow incapacitates the victim in order to remain anonymous while basically committing credit card fraud. This is only of benefit to such a ring with people wealthy enough to target and use their substantial credit limits. But if I were such a wealthy person, I wouldn't want to be the victim of such a group, regardless of who's responsible for the fraud. That would be the least of my concerns. Is this likely to happen to anybody? Not really. Could it? Yes. Should wealthy people worry about it? No. But as with any other aspect of flaunting their wealth where they might be vaunerable, they might want to be discreet about using Pay on their watch in certain situations, just as they wouldn't want to produce a wallet and flash a stack of hundreds in some cases.
 
The perpetrator would only get a 'few hours' according to some people before the battery dies and they will have to take it off to charge!

Ha! Good point, and possibly the best one yet for why this wouldn't be very effective ...

I'd imagined some wealthy businessman at a night club or hotel bar in Hong Kong during a business trip at the end of a long day, so the watch would probably be at the end of its charge as it is, and the thieves wouldn't get very far. It would be much harder to pull something like this off unibserved during the day, when the victim will also be missed.

So point to Apple for having such a limited battery life. So the wealthy won't really have to worry about this kind of crime at all until the battery life gets longer, by which time Apple will have fixed this problem. ;-)
 
I had a girlfriend one time who was irritated by the person driving behind us following too close, and she said "let them hit us, it will be their fault".

Who's responsible for an accident isn't really the point. I think I'd rather not have the accident.

I was the first person to post on this thread discrediting the assertion of the OP. I'm definitely not worried about this, nevertheless, it's interesting to discuss. The only way this works is with some kind of elaborate Watch crime ring, which somehow incapacitates the victim in order to remain anonymous while basically committing credit card fraud. This is only of benefit to such a ring with people wealthy enough to target and use their substantial credit limits. But if I were such a wealthy person, I wouldn't want to be the victim of such a group, regardless of who's responsible for the fraud. That would be the least of my concerns. Is this likely to happen to anybody? Not really. Could it? Yes. Should wealthy people worry about it? No. But as with any other aspect of flaunting their wealth where they might be vaunerable, they might want to be discreet about using Pay on their watch in certain situations, just as they wouldn't want to produce a wallet and flash a stack of hundreds in some cases.

Just as long as they don't steal your Apple Watch AND your tinfoil hat.
 
I am shocked by this terrible news, I am going to return all my tech products tomorrow, I lost hope and faith.
#justdreamsnow
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.