An Apple ID controls iCloud photos, backups, purchases, Find My, devices, and sometimes the email used to reset other accounts. If you see unfamiliar activity or cannot sign in, work in order: regain control, remove access, then check damage.
Does this affect you?
Use this for any Apple ID or iCloud account used on iPhone, iPad, Mac, or iCloud.com when you suspect someone else has access.
If you can still sign in
Start by changing the password, because that removes most unauthorized sessions.
- On iPhone or iPad, open Settings and tap your name. On a computer, type appleid.apple.com and sign in.
- Open Sign-In & Security and choose Change Password. Use a long, unique password you have not used anywhere else.
- Confirm Two-Factor Authentication is on under Sign-In & Security. Turn it on if available and not already enabled.
- Review the list of devices signed in to the account. Remove any iPhone, iPad, Mac, or browser session you do not recognize.
- Check Trusted Phone Numbers and make sure every number belongs to you. Remove anything unfamiliar.
- Review Mail and iCloud settings for forwarding rules, linked addresses, or sharing settings you did not create.
If you are locked out completely
Use Apple’s recovery route instead of search-result links or phone numbers from messages.
- Go to iforgot.apple.com from any browser.
- Enter your Apple ID email address or phone number.
- Follow Apple’s identity-verification steps using a trusted device, trusted phone number, or recovery key if you set one up.
- If the usual recovery options no longer work, choose Account Recovery and follow Apple’s waiting process.
- After regaining access, immediately change the password, review devices, check trusted phone numbers, and inspect forwarding settings.
More control
Check money and purchases
Review Settings > your name > Payment & Shipping and check App Store or subscription purchases. Report unfamiliar Apple purchases through reportaproblem.apple.com and monitor the attached card.
Review location and family access
Someone with Apple ID access may see device location through Find My or add themselves to Family Sharing. Check both areas and remove anything unfamiliar.
Understand Recovery Key before enabling it
An Apple Recovery Key can strengthen account recovery but changes the safety net. If you lose the key and trusted devices, Apple may not be able to help you regain access, so store it securely offline.
Check connected accounts
If this Apple ID email is used as a recovery address for banking, email, or other important accounts, review those accounts for unfamiliar recovery numbers, emails, and sign-ins too.
Sources
- Apple Support – If you think your Apple Account has been compromised
- Apple Support – Get help signing in to your Apple Account
- FTC Consumer Advice – Recovering from a hacked email or social media account