Sunday, June 8, 2014

iPads, iCloud security and a Craigslist near miss

I will state up front that I do not condone nor will I knowingly purchase stolen property.  If I think something might be stolen or sounds suspicious, it is not for me.  That being said, one can easily tell from my posts that I do enjoy Craigslist and I enjoy a great buy.  Despite what some living in ivory towers may proclaim, it is not easy sometimes to tell the difference between a scam and a great deal.  In this post, I will relate my “near miss.”

My near miss started with the purchase of a laptop.  A Craigslist ad related a laptop for sale, a Lenovo Edge with an i3 processor.  The catch was that the seller related they were moving so selling quickly was important.  This can be interpreted either way – either they truly are moving and trying to get rid of the stuff they are using OR it might simply be a smokescreen to get your cash through a quick sale.  One of my earlier lessons learned from using Craigslist is that I won’t meet up with someone unless I speak to them on the phone first.  Call this a symptom of my old fart syndrome (OFS) perhaps, but I definitely get a better flavor for the person I’m doing business with.  I also engage the person in conversation during the face to face as well to get clues as to whether it is legit.  And so it was in this instance, I had a conversation on the telephone and through that and additional email exchanges had an overall favorable impression of the seller.  I completed the transaction and have since used the laptop and was very satisfied.  In our conversation, the seller indicated that he was in information technology (IT) and started in programming – referring to COBOL (of which I sampled in college).  This type of conversation suggested to me a legit individual; I don’t think too many street level criminals would be referring to COBOL.  Also, the laptop was set up well (not a mess like I've sometimes seen from casual users).

A couple days later some additional ads showed up for an iPad mini and an iPad 4.  These ads indicated the same small outlying town as my laptop seller and similar “moving” rationale.  So I inquired and asked if these were being sold by “M” and perhaps we could do a package deal.  As it turned out it was “M” who related he was selling a lot more stuff gearing up for his move and a deal was worked out.  I will remark, I felt it was a good deal.   “M” definitely had a bottom line price which would seem to contradict someone selling stolen goods for any fast cash from a gullible customer.  I met “M” and “M” demonstrated that the devices were both reset.  I had read excerpts online about the importance of the device being reset due to the new security in IOS 7.

The next morning came my wake up call.  My daughter had attempted to activate the iPad mini and sure enough a message comes up relating that “this iPad is currently linked to an Apple ID (s*****  Sign in with the Apple ID that was used to set up this device.”  The kicker, of course, is that nothing is set up on that iPad, as the data was wiped and both the seller and I believed that meant it was ready for the new owner.  A series of emails transpired back and forth between me and the seller.  It was a nerve wracking time as the seller indicated being “on the road”.  (During this time, I was left to wonder if he really was on the road or if he may decide he is too busy to be bothered by me or even if this was part of a scam.)

I had not attempted to activate the iPad 4 and with much trepidation, I pulled it out and (gasp) it activated without a problem.  I will also note that I did not activate the mini or iPad 4 at our meeting as my understanding is that Apple permits 4 devices to be on an account and I knew I already had 4 devices on my account.  Additionally, I was looking to wean my daughter off my account and onto her own iTunes account so I didn't want to activate the mini into my account.  In hindsight, if I were to buy another used iPad, I would insist on activating it at the time of sale to verify that the device can be validated by Apple.  For reference, if you are buying a used iPad, work your way to this screen and carefully read the message.  This is your indication that you cannot activate the iPad and you should not buy it!

While I had much anxiety during this process, there were some positive signs.  1. The seller was responding to email and even called by telephone immediately after getting my first message relating that there was an issue; and  2. The iPad 4 did activate.  This was a good sign as it would tend to suggest that this was not a scam whereby someone was just trying to get quick cash for locked iPads.  Aside from an outright scam, I would also interject that given some of the caliber of sellers on Craigslist, you may easily encounter some who would take the position that you bought it “as is” and it is now your problem.

I consider myself extremely fortunate and relieved to find that my impression of the seller was correct.  “M” is a stand-up guy; he worked diligently to try to ascertain the password from his son who had owned the device.  Additionally, he contacted Apple to become more informed about the issue.  Apple had indicated to him that he could use their retrieval system to get the password sent the email of record.  Unfortunately, in consulting with his son, he learned that the email of record was a temporary email address his son had used as part of a school project.  That email account is no longer in existence.  Due to the situation, “M” related that he would refund the purchase which he promptly did.  "M" is now trying to backtrack to obtain documentation of the original purchase so that Apple will assist/

As for my daughter getting an iPad mini, this experience was a wake up call for me.  I was shooting for spending $200 for a used iPad mini which is what I had paid for this iPad.  Prior to this I met a seller who stated he was selling an "as new" iPad mini and willing to accept $200.  Unfortunately, his iPad was not "as new," having several scratches on the screen and one being rather severe.  Target had the iPad mini on sale this week for $269 after using the red card and sales tax, it came to around $275... that extra $75 seemed well worth it after this experience to avoid the risk, stress and wasted time of returning to the search.

My message for buyers is to use extreme caution in the purchase of any used Apple device and look for messages stating that the device is already linked to an Apple ID.  In the case illustrated above, I would consider both myself and the seller very tech savvy and we didn't catch this in advance.

My message to sellers is to remove your Apple device from the iCloud before you reset it and remove your data (including the easy access to the iCloud from your device).

My message for Apple is that I realize you want to protect legitimate owners from theft, but please make your message or lock much more visible to potential new owners.  If it is already locked to an iCloud account, why not have a message saying that immediately when you turn it on.  When you are able to navigate past the "Hello" screen, pick your language and pick your country, it leads buyers to believe that everything is "Ok."  This simply is not fair to legitimate buyers who can't afford your newest device.

Apple's support information relating to this issue is here:

I emphasize this portion:
Follow each of these steps to make sure that you can use the device you purchase:

1.  Turn the device on and slide to unlock.
If the passcode lock screen or the home screen appears, the device has not been erased. Ask the seller to completely erase the device by going to Settings > General > Reset > Erase All Content and Settings. Do not take ownership of any used iPhone, iPad, or iPod touch until it has been erased.

2.  Begin the device setup process.
After choosing a language, choosing a country, and connecting to a network, the device will begin activation. If you are asked for the previous owner’s Apple ID and password, the device is still linked to their account. Hand the device back to the seller and ask them to enter their password. If the previous owner is not present, they can remove the device from their account by signing in to Do not take ownership of any used iPhone, iPad, or iPod touch until it has been removed from the previous owner’s account.

You will know that a device is ready for you to use when you are asked to “Set up your iPhone", “Set up your iPad", or “Set up your iPod” during the device setup process.