Apple Account (Apple ID) Hacked? How to Recover and Secure It

Your Apple Account — what Apple used to call your Apple ID — holds your photos, messages, passwords, purchases and the ability to lock or erase your devices. If someone else gets in, it’s serious, but Apple has solid recovery tools if you use them in the right order. Here’s what to do if your Apple Account has been hacked, whether you can still sign in or you’ve been locked out.

Short Answer

If your Apple Account is hacked but you can still sign in, change your password immediately from a trusted iPhone, iPad or Mac, then remove unknown devices and phone numbers. If you’re locked out, go to iforgot.apple.com. If you can’t verify with a trusted device or number, Apple starts Account Recovery — a waiting period that can last days — and you should avoid using devices signed in to the account while it runs. After you’re back in, review payment methods and purchases, set up a Recovery Contact or Recovery Key, and consider security keys.

Signs Your Apple Account Has Been Compromised

Emails from Apple about a sign-in, password change or new device you don’t recognise
Your password suddenly stops working
Unknown devices listed in Settings → [your name] → Devices
Purchases or subscriptions you didn’t make
Your trusted phone number or email has been changed
A device shows as locked or erased through Find My without your action
Repeated password-reset prompts on your devices that you didn’t request

Check the email is really from Apple

Scammers send fake “your Apple ID is locked” emails and texts to steal passwords. Don’t click links in these messages. Instead, open Settings on your iPhone or go directly to account.apple.com to check your account.

Change your password from a trusted device. On iPhone: Settings → [your name] → Sign-In & Security → Change Password. Use a strong, unique password.
Remove unknown devices. In Settings → [your name], scroll to your device list. Tap anything you don’t recognise and choose Remove from Account.
Check trusted phone numbers and emails. In Sign-In & Security, remove any number or address that isn’t yours and make sure yours are listed.
Review payment methods. Settings → [your name] → Payment & Shipping. Remove anything unfamiliar.
Check purchases and subscriptions. Settings → [your name] → Subscriptions, and review recent purchases in the App Store under your account.
Revoke app-specific passwords and review “Sign in with Apple” apps at account.apple.com.

If You’re Locked Out: Use iforgot.apple.com

If the attacker changed your password, go to iforgot.apple.com (or use the “Forgot password?” option on any Apple device sign-in screen). Apple will try to verify you through a trusted device or trusted phone number. If you have one, you can usually reset the password right away.

If you have a Recovery Key (a 28-character code you may have set up), you’ll need it along with a trusted device. If you set up a Recovery Contact, they can generate a code on their device to help you back in.

What Is Apple’s Account Recovery Waiting Period?

When you can’t verify your identity through a trusted device, number or recovery option, Apple uses Account Recovery. It’s a deliberate waiting period — often several days, and sometimes longer — while Apple checks that nobody else is trying to take over the account. People report different waits (a few days to a few weeks), depending on what information is provided.

Don’t cancel your own recovery

Apple advises turning off other devices signed in with your Apple Account while recovery is in progress. Using a signed-in device during the waiting period can cancel the request, and you’d have to start again. Apple Support can check your status but can’t speed it up.

Contact Apple Support the Right Way

Start at getsupport.apple.com or the Apple Support app, and choose the Apple Account and password options. Apple will never call you out of the blue asking for your password or verification code. If someone “from Apple” contacts you first, hang up and reach Apple through official channels yourself.

After You’re Back In: Secure Everything

Turn on Stolen Device Protection on your iPhone (Settings → Face ID & Passcode) so sensitive changes need Face ID away from familiar locations.
Set up a Recovery Contact — a trusted person who can help you regain access in future.
Consider security keys. Apple supports physical security keys for Apple Accounts, which block most phishing.
Check Find My — make sure all your devices are listed and none have been erased or locked. Our guide to fixing Find My iPhone helps if something looks wrong.
Change reused passwords. If your Apple password was used elsewhere, change it there too. A password manager makes unique passwords easy.
Check iCloud Keychain passwords for accounts the attacker might have accessed, and change the important ones.

Getting Money Back for Unauthorised Purchases

If the attacker bought apps, subscriptions or media, request refunds at reportaproblem.apple.com, choosing the option for purchases you didn’t make. If Apple Pay or a card on file was used elsewhere, contact your bank or card issuer to dispute the charges and replace the card.

What an Attacker Can Access With Your Apple Account

Knowing what’s exposed helps you prioritise. With your Apple Account password and a way past two-factor authentication, someone could potentially:

View iCloud Photos, Notes, Contacts, Calendars and iCloud Drive files on the web
Use Find My to see device locations, or lock and erase devices
Make App Store and iTunes purchases with saved payment methods
Read iMessages on a newly signed-in device, depending on your settings
See passwords in iCloud Keychain if they also get past your device security
Change your trusted phone number or recovery settings to lock you out

Your device passcode is separate from your Apple Account password. If your iPhone passcode is strong and private, an attacker on another device still can’t unlock your phone itself — which is why Stolen Device Protection and a good passcode matter as much as the account password.

How Apple Accounts Usually Get Hacked

It’s rarely a sophisticated break-in. Most takeovers come from phishing messages that copy Apple’s style, reused passwords leaked from other sites, and people being tricked into reading out a verification code over the phone. A growing trick is “MFA fatigue” — bombarding you with password-reset prompts until you tap Allow. If you see repeated reset notifications you didn’t request, tap Don’t Allow every time and change your password from Settings.

Protect Your Family’s Apple Accounts Too

If you manage Family Sharing, a compromised account can affect shared purchases and payment methods. After recovering your own account, check that Family Sharing members, purchase sharing and Ask to Buy settings look right, and remind family members to turn on two-factor authentication and set up their own Recovery Contacts. Older relatives are frequent phishing targets, so a quick walkthrough of what real Apple messages look like goes a long way.

Change your password from a trusted device if you still have access
Use iforgot.apple.com if you’re locked out
Account Recovery takes days — don’t use signed-in devices while it runs
Remove unknown devices, numbers and payment methods
Add a Recovery Contact, turn on Stolen Device Protection, consider security keys

Frequently Asked Questions

How long does Apple Account recovery take?

It varies. If you can verify with a trusted device or number, it can be immediate. Account Recovery, used when you can’t, can take several days or longer, and Apple can’t speed it up.

Is Apple ID the same as Apple Account?

Yes. Apple renamed Apple ID to Apple Account; the recovery process is the same.

Can a hacker erase my iPhone?

With your Apple Account password, someone could use Find My to lock or erase devices. That’s why changing your password and checking your device list quickly matters.

Should I create a new Apple Account instead?

Usually not. A new account means losing access to past purchases, iCloud data and subscriptions tied to the old one. Recovering the original account is almost always better.

Can I recover my account without my trusted phone number?

Yes, through Account Recovery at iforgot.apple.com, though it takes longer. A Recovery Contact or Recovery Key set up in advance makes this much faster.

Will Apple call me about a hacked account?

Apple won’t cold-call you asking for passwords or codes. Treat unexpected calls claiming to be Apple as scams and contact Apple through getsupport.apple.com instead.

Does two-factor authentication stop Apple Account hacks?

It stops most password-only attacks. Attackers then try to trick you into sharing a code or approving a prompt, so never share codes and deny any sign-in request you didn’t start.

The Bottom Line

Speed matters most while you can still sign in: change the password, clear out unknown devices and numbers, and check payments. If you’re locked out, iforgot.apple.com and Account Recovery will get you back — patiently. For other accounts, see our guides to recovering a hacked Google account and recovering a hacked WhatsApp.

Last updated: October 11, 2026. Sources: Apple Support — account recovery, Apple Community.

Only Apps & Software All Techtippr updates Subscribe now on Telegram