“The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the AirTag has been set to lost mode.”
Lost Mode doesn’t check what goes into the phone number field. Put code there and whoever scans the tag lands on a fake iCloud login. Drop a $30 AirTag in a parking lot and wait for a helpful stranger. It is the old USB stick trick, with Apple’s domain on the link.