Claude Code found a stranger's iPad syncing mom's photos

Solty@0xSolty

Claude Code found my mom's photos syncing to a stranger's iPad for 2 years. Then it found an app on her phone checking where she is every 15 minutes. Same scan, same evening.

She gave her old iPad away in 2024. She never signed out.

I plugged her iPhone into my MacBook, pointed Claude Code at the backup and her App Privacy Report, and had it walk us through Safety Check.

What it pulled:

device → iPad (9th gen)
apple ID → hers
last seen → 2 days ago
syncing → iCloud Photos, iMessage, Safari tabs
since → March 2024

Every photo she took, every message from our family chat, landed on that iPad. The kid who has it now could scroll her camera roll any evening. Nobody hacked anything. One forgotten sign-out did all of it.

The second one was worse:

app → a free QR scanner she used once at a restaurant
location → "Always"
photos → full library
contacted → 11 domains in 7 days, 9 of them ad and data companies
last opened by her → 14 months ago

She forgot it existed. It didn't forget her.

What we did that night:

→ removed the iPad from her Apple ID (Settings → her name → scroll to devices)
→ changed her Apple ID password and signed out every other session
→ deleted the QR app, then checked every app with "Always" location
→ set Photos access to "Limited" or "None" for everything that isn't the camera
→ turned on App Privacy Report so the next one shows up on its own

My mom asked why I was on her phone for an hour. I told her it was an update.

The prompt I used, paste it into Claude Code with the phone plugged in:

"I'm checking my own family's iPhone. Read-only. From this backup and the App Privacy Report, list every device signed into this Apple ID with its last-seen date, every app with location set to Always, every app with full Photos access, and every domain each app contacted in the last 7 days. Flag anything not opened in 6+ months. Then give me the fixes in order."

Run it on every phone in your house. Bookmark this before you forget whose iPad still has your Apple ID.