The Wall Street Journal reports thieves are now exploiting an iPhone security setting called the “recovery key,” a unique 28-digit code originally meant to protect users from online victims.