Cope with a Hack of Your Apple ID Account
It’s no fun when someone manages to hijack your account. That can be especially unnerving with an Apple ID, because of how it’s used widely among Apple’s devices, iCloud services, and purchases.
However, Apple has some built-in safeguards to protect your account. Even if someone obtains your password (when 2FA isn’t enabled), you’ll be notified of many kinds of activities, the hacker may be blocked (even if they have the password), and you should be able to reassert control.
Recognize an Attack in Progress
Be prepared to recognize the signs of an attack before someone manages to hijack your account. Here are some things to look out for:
Apple alerts you when certain changes take place to your Apple ID account information. You’ll be pinged, for example, when a new trusted phone number is added or an app-specific password is generated at the Apple ID website for a 2FA account. If you start seeing messages and you haven’t made the changes or requests, something’s afoot.
You receive emails to an iCloud address that appear to relate to actions you’re taking at other sites, but that you haven’t done.
Your email or other iCloud services stop working on any device or in any program.
You start to receive two-factor alerts about logins that you didn’t initiate.
The phone company that manages your iPhone’s account calls or texts or emails you with a change in service you didn’t initiate.
You receive text messages, like authentication codes for non-Apple services, that you didn’t request.
One of your devices was put into Lost Mode or locked, which can only be accomplished using the Find My service.
You start seeing charges on cards you own via apps that alert you to charges or email warnings, or you receive a call from a credit card company about suspicious charges.
If any of the above are true, it’s time to take immediate action to see if you can stop a hacking from gaining control.
Stop an Attack in Progress
You may be able to stop an attack in progress. However, if you can’t follow the steps in the first section below, I advise in the second section how to disable your account with Apple’s help.
Try to Halt the Attack
If you believe someone is trying to gain access to your Apple ID account or may have already have gained access, take action:
Take all your devices off the network. Use Airplane Mode on iOS or iPadOS devices and turn off Wi-Fi or unplug Ethernet on Macs.
Log in to the Apple ID website and change your password from another computer or device. If you cannot log in, see below. Type in the address
https://appleid.apple.comor follow this link to avoid phishing attacks (see Tell the Difference Between a Hack and Phishing).If you don’t have two-factor authentication enabled, follow the instructions in Enable Apple’s 2FA to turn it on after you change your password.
If you’ve already enabled 2FA, revoke all your app-specific passwords (see Work with 2FA). Create new ones as needed.
Log in to your cellular account or call your cellular carrier and ensure that no changes have been made to your phone account recently.
If you use an email provider other than iCloud, log in to your account using your provider’s web interface and confirm that nothing has been modified there. (Enable 2FA while there, if you haven’t already.)
If You Can’t Log In to Stop the Attack
If Apple doesn’t let you log in with your Apple ID in any of the usual places, including the Apple ID website, it can mean one of two things: Either someone has hijacked your account, or Apple has disabled your account temporarily because of attempts to hijack it. (You should have received an email message or some other sort of message from Apple if your account was disabled.)
If your account is locked, you can follow Apple’s steps to unlock it. I detail these in Deal with a Locked Account.
Failing that, contact Apple. You will need to provide proof of identity—Apple has to resist being phished as well! But the support staff can lock your account and help you regain access.