They are getting smarter. A family member had their phone stolen and Find My iPhone reported that the phone was off for months and so she gave up searching. One day, she got a text on her new phone saying "Find my iPhone has found your phone, click here to login to Find my iPhone". It turned out to be a phishing page for her AppleID credentials. She fell for it and I'm assuming the thieves were able to finally get into her phone. To this day I have no idea how they were able to get her phone number. From the SIM maybe?