The Caller ID Exploit
By default, iOS allows anyone who picks up your phone to interact with the missed call notifications sitting on your Lock Screen. Incredibly, the operating system permits a user to tap a missed call alert and instantly dial the person back, even when the iPhone is completely locked and secured with Face ID. This means a malicious actor who steals your phone (or a snooping roommate) can initiate an outbound phone call from your number, impersonating you to your contacts, without ever knowing your passcode. You must permanently seal this outbound communication vulnerability.
How to Disable Return Missed Calls on the Lock Screen
You can permanently secure your cellular dialing pipeline via the Face ID & Passcode settings.
- Open the Settings app on your iPhone.
- Scroll down and tap on Face ID & Passcode (or Touch ID & Passcode).
- Enter your strict device passcode to authenticate.
- Scroll down to the section labeled “Allow Access When Locked.”
- Locate the toggle switch labeled Return Missed Calls.
- Toggle this switch to the Off position (the green background will disappear).
A Hardened Cellular Perimeter
The change takes effect instantly. The iPhone will completely sever the bridge connecting the background Phone daemon to the Lock Screen notification renderer while the device is locked. You can now leave your phone unattended; if you miss a call and a malicious actor taps the notification on the Lock Screen, the operating system will absolutely refuse to initiate the cellular connection. To return the call, you are now strictly required to unlock the phone with Face ID first, guaranteeing absolute cryptographic control over your outbound dialer.