How did the person that stole his phone know his phone password or able to bypass the face unlock or fingerprint? I know this is not a question that you can answer but I think without a threat like a wrench attack, the bad actors should not be able to have access to his phone, not to talk of having access to his exchange account. (...) Maybe the phone got stolen while the phone was unlocked  ? But it's still fishy because even if it's unlocked and some phones and exchanges will ask verification again, like biometrics, even if the phone is unlocked already. Yeah, Biometric still important because most of exchange now only have 2FA and email verification to login or withdraw, so if phone is stolen and unlocked, they can easily open your 2FA app in your phone and the email app you are using. Wait... Aren't you aware phone can be used without password?  Setting Password, facial verification or biometric on your device is optional and not compulsory before you can make use of the phone. Some people prefer to use their phone with just a slide to unlock the screen. In this case, the thief doesn't have anything to worry about with unlocking the phone. What is confusing here is how the exchange allows a withdrawal with 2FA which is a secondary security feature on exchanges. Password is the primary security for log in and approve transactions while email and SMS verification are alternatives primary security. While some exchanges made it mandatory to set 2FA, others made it optional. I see it as a flaw for exchange to rely on 2FA alone.
How did the person that stole his phone know his phone password or able to bypass the face unlock or fingerprint? I know this is not a question that you can answer but I think without a threat like a wrench attack, the bad actors should not be able to have access to his phone, not to talk of having access to his exchange account. (...) Maybe the phone got stolen while the phone was unlocked  ? But it's still fishy because even if it's unlocked and some phones and exchanges will ask verification again, like biometrics, even if the phone is unlocked already. Yeah, Biometric still important because most of exchange now only have 2FA and email verification to login or withdraw, so if phone is stolen and unlocked, they can easily open your 2FA app in your phone and the email app you are using. Wait... Aren't you aware phone can be used without password?  Setting Password, facial verification or biometric on your device is optional and not compulsory before you can make use of the phone. Some people prefer to use their phone with just a slide to unlock the screen. In this case, the thief doesn't have anything to worry about with unlocking the phone. What is confusing here is how the exchange allows a withdrawal with 2FA which is a secondary security feature on exchanges. Password is the primary security for log in and approve transactions while email and SMS verification are alternatives primary security. While some exchanges made it mandatory to set 2FA, others made it optional. I see it as a flaw for exchange to rely on 2FA alone.

How did the person that stole his phone know his phone password or able to bypass the face unlock or fingerprint? I know this is not a question that you can answer but I think without a threat like a wrench attack, the bad actors should not be able to have access to his phone, not to talk of having access to his exchange account. (...) Maybe the phone got stolen while the phone was unlocked  ? But it's still fishy because even if it's unlocked and some phones and exchanges will ask verification again, like biometrics, even if the phone is unlocked already. Yeah, Biometric still important because most of exchange now only have 2FA and email verification to login or withdraw, so if phone is stolen and unlocked, they can easily open your 2FA app in your phone and the email app you are using. Wait... Aren't you aware phone can be used without password?  Setting Password, facial verification or biometric on your device is optional and not compulsory before you can make use of the phone. Some people prefer to use their phone with just a slide to unlock the screen. In this case, the thief doesn't have anything to worry about with unlocking the phone. What is confusing here is how the exchange allows a withdrawal with 2FA which is a secondary security feature on exchanges. Password is the primary security for log in and approve transactions while email and SMS verification are alternatives primary security. While some exchanges made it mandatory to set 2FA, others made it optional. I see it as a flaw for exchange to rely on 2FA alone.

How did the person that stole his phone know his phone password or able to bypass the face unlock or fingerprint? I know this is not a question that you can answer but I think without a threat like a wrench attack, the bad actors should not be able to have access to his phone, not to talk of having access to his exchange account. (...) Maybe the phone got stolen while the phone was unlocked  ? But it's still fishy because even if it's unlocked and some phones and exchanges will ask verification again, like biometrics, even if the phone is unlocked already. Yeah, Biometric still important because most of exchange now only have 2FA and email verification to login or withdraw, so if phone is stolen and unlocked, they can easily open your 2FA app in your phone and the email app you are using. Wait... Aren't you aware phone can be used without password?  Setting Password, facial verification or biometric on your device is optional and not compulsory before you can make use of the phone. Some people prefer to use their phone with just a slide to unlock the screen. In this case, the thief doesn't have anything to worry about with unlocking the phone. What is confusing here is how the exchange allows a withdrawal with 2FA which is a secondary security feature on exchanges. Password is the primary security for log in and approve transactions while email and SMS verification are alternatives primary security. While some exchanges made it mandatory to set 2FA, others made it optional. I see it as a flaw for exchange to rely on 2FA alone.