Originally Posted by
darriusghodges He was riding a coaster at six flags the iPhone 6s fell and was found then stolen by the person who found it at the theme park. Apple promote that the phone is secure with the finger print and that it is totally locked down in lost mode. The fraudulent iMessages proves that hackers know how to get some information out of the phone. But they are trying very hard for people who do not know any better to click the link and put the Apple ID and password into the website that looks very much like the apple find my iPhone site. What tipped me off to the scam is there was "S" missing from the "http" link. I called apple and they confirmed that they did not send the iMessages.
If your son allowed for Siri to be accessed via the lock screen AND your son has a contact card for himself, all the person who found/stole device has to do is ask Siri whose phone it is. Siri will then state whose phone it is and display the owner's contact card bearing the phone number. Having said that, if you transferred the phone number to the replacement iPhone, the thief already has it and therefore can easily send a message/phishing link to the current iPhone. The iPhone is as secure as the owner allows it to be.