Apple ID Hacked? What to Do to Secure Your Apple Account

If your Apple ID was hacked, treat it as an Apple Account takeover and act from a trusted device first. Change or reset the password, remove unknown devices, check email and phone recovery details, sign out of web iCloud sessions, review purchases, and avoid any caller or message that asks for your verification code. If the attacker changed the password or trusted phone number, start account recovery through Apple’s official process instead of trusting “recovery” helpers.

This page uses “Apple ID” because many people still search for that term, but Apple now calls it Apple Account. The same email address or phone number and password still apply. The risk is not only that someone reads iCloud photos. A compromised account can expose messages, contacts, files, device location, purchases, recovery settings, and trusted-device prompts.

Do This First

1. Use a trusted device or a clean browser. Do not follow links from the warning email, text, pop-up, or caller. Open Settings on your own iPhone, iPad, or Mac, or type the official Apple account address yourself.
2. Change the Apple Account password. On iPhone or iPad, open Settings, tap your name, then Sign-In & Security, then Change Password. On Mac, use System Settings, your name, Sign-In & Security.
3. If the password no longer works, start recovery. Use a trusted Apple device when possible. If you do not have one, use the Apple Support app on a borrowed Apple device or go to iforgot.apple.com in a browser you typed yourself.
4. Remove unknown devices. Check the device list under your Apple Account. Remove laptops, phones, browsers, Apple TV, HomePod, or Windows/iCloud entries you do not recognize.
5. Check email, phone numbers, and recovery details. If an attacker changed a trusted phone number or email, do not assume a password reset alone fixed the account.
6. Sign out of iCloud web sessions. If you use iCloud.com, open iCloud settings and sign out of all browsers. Consider turning off iCloud web access if you do not need it.
7. Check purchases and payment methods. Review App Store, subscriptions, Apple Pay-related alerts, and bank statements. Contact your bank quickly if you see unauthorized charges.
8. Secure the email account behind your Apple Account. If that mailbox is compromised, attackers can keep receiving reset messages or delete Apple warnings before you see them.

Signs Your Apple Account May Be Compromised

A real compromise usually leaves a trail. Apple says warning signs include an unrecognized sign-in, an unexpected two-factor code, unfamiliar messages or deleted items, trusted devices you did not add, purchase activity you do not recognize, a password that stops working, or a device placed in Lost Mode by someone else.

• You receive an Apple notification or email about a sign-in from a device or location you do not recognize.
• You get a two-factor authentication code when you were not trying to sign in.
• Your password stops working or your trusted phone number looks changed.
• Unknown devices appear in your Apple Account, Find My, iCloud for Windows, HomePod, Apple TV, FaceTime, Messages, Mail, Calendar, or Media & Purchases settings.
• You see App Store, iTunes, Apple Pay, subscription, or in-app purchases you did not make.
• Messages, files, contacts, photos, notes, or calendar items appear, disappear, or change without your action.
• Your iPhone or iPad is marked as lost, locked, or erased without your consent.
• You are pressured by a caller, text, or email to share a password, passcode, recovery key, or verification code.

How Apple ID Takeovers Usually Happen

Most Apple Account takeovers are not a breach of Apple itself. They usually start with reused passwords, a compromised email inbox, phishing pages, fake Apple Support calls, stolen devices, or malware on a computer where the victim saved browser passwords or session cookies.

Phishing emails, texts, and fake Apple Support calls

Attackers often send “Apple ID locked”, “iCloud storage full”, “Apple Pay unusual activity”, “purchase confirmation”, or “your lost iPhone was found” messages. Some campaigns push victims to call a fake support number instead of clicking a link. Calling feels safer, which is why the trick works: the operator then asks for a verification code, remote-access session, gift card payment, or account password.

If a message claims your account is under attack, do not use its link or phone number. Go directly through Settings, account.apple.com, the Apple Support app, or Apple’s published support channels.

Unrequested two-factor prompts

An unexpected verification code does not always mean the attacker is already inside. It can mean someone has your password and is trying to pass the second factor. Do not tap Allow, do not read the code to anyone, and change the password from a trusted device. If the prompt repeats, also check whether your email account, password manager, or another device is compromised.

Compromised email or phone number

Your Apple Account depends on reachable email addresses and trusted phone numbers. If a mailbox has weak security or a mobile number is vulnerable to forwarding or SIM-swap fraud, an attacker may control the recovery path. Secure the email first, enable MFA on it, remove forwarding rules you did not create, and contact your carrier if you suspect SMS forwarding or SIM-swap abuse.

Malware, infostealers, and suspicious apps

If the incident started after installing a cracked app, fake game, browser extension, “support tool”, or remote-access program on a Mac or Windows PC, secure the Apple Account from a different trusted device. Then scan the computer before trusting saved passwords again. A second-opinion scan with Gridinsoft Anti-Malware can help find stealers, unwanted apps, and browser threats that may have exposed account data.

Lost or stolen iPhone

If the device was stolen, mark it as lost through Find My or iCloud Find Devices. Do not remove it from Find My just because a text says the phone was found. Apple warns that removing a device can weaken Activation Lock protection. Also be alert for phishing texts sent after a theft; they often try to steal the Apple Account password so the thief can unlock and resell the device.

What To Check Inside Your Apple Account

Once you can sign in, work through the account like an investigator. The goal is to remove the attacker’s foothold, not just change one password.

• Sign-In & Security: verify primary email, reachable emails, trusted phone numbers, password status, two-factor authentication, recovery contact, and recovery key settings.
• Devices: remove anything unfamiliar, old, sold, or lost. Unknown devices can display verification codes and maintain access to Apple services until removed.
• iCloud: check Photos, Drive, Notes, Mail, Calendar, Contacts, backups, and iCloud web access. Sign out of all browsers if web access may have been abused.
• Find My: check device locations and Lost Mode status. Keep stolen devices in Find My while you are pursuing recovery or a theft claim.
• Media & Purchases: review purchases, subscriptions, payment cards, and unfamiliar billing details.
• Messages and FaceTime: make sure only your phone numbers and email addresses are reachable there.
• Mail and Calendar: look for forwarding, spam, calendar subscriptions, or messages you did not send.

If You Are Locked Out

If the attacker changed the password, trusted phone number, or recovery details, recovery may take time. Use Apple’s official account recovery path and be patient with the waiting period. Do not pay anyone who says they can hack the account back, bypass Activation Lock, or recover iCloud data for a fee. Those offers are usually recovery scams.

While waiting, protect what you still control:

• Secure the email account used for your Apple Account.
• Ask your cellular carrier to check for SIM-swap or SMS-forwarding risk.
• Contact your bank or card issuer if purchases or Apple Pay activity look suspicious.
• Keep screenshots of unauthorized changes, unknown devices, charges, and support case numbers.
• Warn family members if your account can send iMessage, FaceTime, or email scams in your name.

What Victims Search For and the Safer Answer

How To Prevent Another Apple Account Takeover

• Use a long, unique Apple Account password that is not reused anywhere else.
• Keep two-factor authentication enabled.
• Keep trusted phone numbers, recovery contacts, and email addresses up to date.
• Use a strong passcode and biometric unlock on Apple devices.
• Turn on Stolen Device Protection on supported iPhones.
• Consider Security Keys only if you understand the lockout risk and can keep backup keys safe.
• Do not store your Apple Account password in a browser profile on a computer you use for risky downloads.
• Review the device list every few months and after selling, gifting, or losing a device.
• Use the Apple ID scams guide to recognize fake locked-account, billing, iCloud, and support messages before you click.

When To Scan Your Computer

Scan your Mac or Windows PC if you entered your Apple password after a suspicious pop-up, installed a “support” app, ran a cracked download, opened a suspicious attachment, or noticed browser redirects around the same time. Account cleanup works best when the device used for recovery is trustworthy. If malware remains active, it can steal the new password or session again. If the warning followed a fake game, mod, launcher, or crack, use the infostealer game/mod cleanup checklist before signing back in from that computer.

For related cleanup, see our guides on how to spot phishing emails, fake “Your iPhone has been hacked” pop-ups, and Calendar spam on iPhone.

FAQ

References

1. Apple Support. “If you think your Apple Account has been compromised.” Apple, updated December 5, 2025. Accessed June 7, 2026. https://support.apple.com/en-us/102560
2. Apple Support. “Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams.” Apple, accessed June 7, 2026. https://support.apple.com/en-us/102568
3. Apple Support. “How to find your lost iPhone or iPad.” Apple, accessed June 7, 2026. https://support.apple.com/en-us/101593