2FA isnt if you use a standalone 2FA app or key to authenticate.
Once they had the number and sim they were able to use the "forgot password" stuff for Twitter which would give them access to his DMs there, do the same for iCloud and then if he had anything sync'd to the cloud it would restore to that iphone, same with GMail.
2FA isnt if you use a standalone 2FA app or key to authenticate.
Once they had the number and sim they were able to use the "forgot password" stuff for Twitter which would give them access to his DMs there, do the same for iCloud and then if he had anything sync'd to the cloud it would restore to that iphone, same with GMail.