According to a recent Wall Street Journal investigation, some iPhone thieves are taking advantage of a security feature known as the recovery key, which makes it nearly impossible for owners to retrieve their data, texts, images, and more.

A few victims also informed the publication that after the crooks obtained access to their financial applications, their bank accounts were completely depleted.

It’s crucial to remember, though, that this kind of takeover is challenging to execute. It basically involves a criminal observing an iPhone user enter the passcode—say, peering over their shoulder at a bar or sporting event—or coercing the owner of the device into disclosing the passcode. And that’s all prior to them taking the gadget by force.

After that, a thief might use the passcode to modify the Apple ID of the device, disable “Find my iPhone” to prevent location tracking, and reset the recovery key—a complicated 28-digit code meant to shield its owners from cybercriminals.

In an attempt to increase user security, Apple requires this key in order to reset or regain access to an Apple ID. However, if a thief changes it, the original owner will not have the new code and will be locked out of the account.