Samsung phone stolen and google/paypal passkeys

Associate
Joined
10 Jan 2016
Posts
2
I had my Samsung Galaxy S9 stolen in Thailand a couple of weeks ago. I have now returned to the UK and I'm in the process of setting up my new phone....

I wasn't actually that worried about the phone being stolen at first because it was damaged and needed replacing. The phone was also protected by both a PIN and/or fingerprint so I didn't think anyone would be able to get into it. That was until I checked my email and noticed these emails in my inbox!...



I had both banking and crypto apps on the phone so the above terrified me. Thankfully though, up to now, I haven't noticed any unusual activity in either my banking or crypto accounts.

I assume those emails mean they must have got into my phone somehow which suggests they will have access to both my Gmail and my WhatsApp (as neither of those are password/fingerprint protected). All the important apps (ie. Banking and Crypto) are password and/or PIN protected so I am hoping those are safe. I don't actually know how much they can access by getting into my Samsung account as I never used Samsung Pay or any other Samsung apps... hopefully not much!

As there seemed to have been no movement in either my banking or crypto accounts I was starting to relax a bit... that was until I came across a passkey, that I didn't set up myself, when trying to access Paypal through my new phone:



I can actually bypass the passkey and go straight into Paypal using a password - which I did and I'm happy to say there's no unusual activity on there either, however, if I choose to use the "saved" passkey it takes me to a "pattern" screen lock as follows:



What's concerning about this is, whilst I've set up both PIN code and fingerprint passkeys in the past, I've never set up a "pattern" passkey so I'm now worried again that whoever stole my phone has done this! Note the location is Thailand and the date and time are pretty much around the same time that the phone was stolen (or maybe just after). Does this represent the date and time the passcode was set up? Or something else?

I'm extremely worried now about what the person who stole my phone can access. I've taken all steps I can think of to protect myself including removing the stolen phone from Google and Paypal devices page. Whilst looking at the Google security settings I came across the 'Passkeys and security keys' page which lists 'Automatically created passkeys' on my devices (including one on my new phone). Could the "pattern" passkey therefore just be something that Google has set up and is nothing to do with the person who stole my phone at all? If so, where can I find out what pattern Google has automatically set up for me? If that's just wishful thinking on my behalf, any advice on what I should do next to protect myself would be much appreciated.
 
Last edited:
Back
Top Bottom