So, my iPhone was stolen and somehow ended up in China, as I discovered through the Find My app. A few days later, I started receiving iMessages impersonating Apple/Apple Support/Apple Pay, asking me to remove my phone from Find My iPhone to disable the activation lock. This seems like a common tactic, judging by quick online research.

However, what I can’t figure out is how they managed to get my Apple ID or associated contact information from a locked device to send their iMessages to. Here’s what I’ve ruled out:

1. Removing the SIM card: This wasn’t possible because I was using an eSIM.

2. Using Siri: Siri doesn’t reveal any contact information when asked who the phone belongs to.

3. Emergency Contacts or Medical ID: Both were disabled, so they wouldn’t have been visible on the lock screen or through the emergency dialer.

4. Lock screen notifications: I had them set up to not show any sensitive information unless the phone was unlocked.

5. Lost Mode: I had activated lost mode but I chose not to display my contact information because the phone was snatched right out of my hand. I knew the phone was gone, and at that point, I was only concerned about protecting my data.

I’m stumped. Is it possible they’re working with someone who has access to ownership information, like an insider at Apple, a carrier, or a government agency, using the IMEI or Apple ID?

If anyone has insights into how this could happen or additional possibilities I haven’t considered, please share. I’m trying to understand how they connected my locked iPhone to my account.