Apple ID Hacked? What to Do to Get Your Account Back

If your Apple ID has been hacked, change your password straight away from a trusted device (your iPhone, iPad or Mac settings) or through Apple’s official reset page at iforgot.apple.com. Then check the trusted devices, trusted phone numbers and email addresses on the account, remove anything you don’t recognize, and review recent purchases. If you can’t reset the password at all, use Apple’s account recovery process, which restores access after a waiting period.

Apple now calls it an “Apple Account”, but most people still search for Apple ID, and the steps are the same. Because one Apple account can control your iPhone, your photos, your passwords and your payment cards, it’s worth working through this in order rather than fixing just the first thing you notice.

Signs your Apple ID has been compromised

• An email or notification from Apple saying your password, email address or phone number was changed, or that your account was used to sign in on a device you don’t own.
• Your password stops working, or you’re signed out of iCloud on your own devices.
• Purchases, subscriptions or App Store charges you didn’t make.
• A device you don’t recognize appears in your devices list.
• Your iPhone or Mac is suddenly put into Lost Mode, locked or erased through Find My.
• Friends mention odd messages from your iMessage or FaceTime address.

Be careful with the first sign on that list. Fake “Apple security alert” emails and texts are one of the most common phishing tricks. Don’t tap a link in a message to “secure your account”. Go to your device settings or type the Apple web address yourself.

If you can still sign in: secure the account now

If your password still works, you’re in a much stronger position. Work through these steps on a device you trust, ideally one that is already signed in to your Apple account.

1. Change your password. On an iPhone or iPad, the password option sits in the Sign-In and Security part of your account settings. Choose a long password you have never used anywhere else.
2. Review your trusted phone numbers. Two-factor authentication sends codes to these numbers. Remove any number that isn’t yours, and make sure your own current number is listed.
3. Check the email addresses on the account. Remove unfamiliar addresses and confirm your primary email is one you control. Then secure that email account too, because it receives Apple’s reset messages. Our guide to an email account hacked covers that part.
4. Review your devices list. Your account settings show every device signed in with your Apple ID. Tap any device you don’t recognize and remove it.
5. Check signed-in apps and app-specific passwords. Revoke anything you don’t recognize, including apps using “Sign in with Apple” that you never set up.
6. Check payment methods and purchase history. Remove cards you didn’t add and note any purchases you didn’t make.
7. Update your security questions or recovery options if your account still uses them, and consider adding a recovery contact or recovery key (see below).

If you’d rather use a browser, you can sign in at Apple’s account website and see most of the same settings. Type the address yourself rather than following a link.

If you’re locked out: Apple’s official recovery routes

If the hacker changed your password, you have two official routes. Both are free, and neither requires anyone outside Apple.

Reset your password

Try a reset first. On a trusted device that is still signed in, you can usually change the password using your device passcode. Without a trusted device, go to iforgot.apple.com, enter your Apple ID email or phone number, and follow the prompts. Apple may send a code to a trusted phone number or ask you to confirm details about the account.

You can also start a reset from a family member’s or friend’s Apple device using the Apple Support app, which has an option to help someone else reset their password. It doesn’t give them access to your account.

Use account recovery

If you can’t reset the password because you no longer have a trusted device or trusted phone number, Apple offers account recovery. You start it from the same iforgot.apple.com flow. Apple then reviews the request and, after a waiting period, sends instructions to regain access.

That wait is deliberate. It’s designed to stop a thief who has some of your details from taking over your account quickly, and the length depends on how much information you can verify. Apple says that during the wait, using a device that is signed in to the account can cancel the request, so it’s usually best to leave your other devices alone until recovery completes. Check for updates through the contact details you gave, and don’t open multiple requests.

Check Find My and your devices

Someone with your Apple ID and password can use Find My to see your devices’ locations and, in some cases, lock or erase them. That makes this step urgent.

• If a device was put into Lost Mode with a message asking you to call a number or pay to release it, don’t call or pay. Once you’ve regained control of your account, you can turn off Lost Mode yourself.
• If a device was erased, you can restore it from an iCloud backup after you’ve secured the account. Activation Lock stays tied to your Apple ID, which is another reason to get the account back through official recovery.
• On iPhone, run Safety Check (in Privacy and Security settings). It helps you review who and what has access to your account and location, sign out of other devices and reset privacy permissions.
• Turn on Stolen Device Protection on your iPhone if it’s available on your version of iOS. It adds extra checks before sensitive account changes are made away from familiar locations.

Check purchases, subscriptions and connected accounts

Once you’re back in, look at what the account was used for.

• Purchases: review your purchase history for apps, in-app purchases, media and subscriptions you didn’t make. Apple has a “report a problem” route for unauthorized App Store and iTunes purchases, and you can also contact Apple Support.
• Subscriptions: cancel anything you didn’t sign up for.
• Your bank or card issuer: if the account was used to spend money, tell your card issuer too, and ask whether they recommend a replacement card.
• Apple Pay and Apple Cash: check for payments you didn’t send. Contact Apple and your bank about anything suspicious.
• Saved passwords: if you use iCloud Keychain or the Passwords app, assume the intruder may have seen them. Change passwords for your email, bank and main social accounts, starting with the most important.
• Accounts using “Sign in with Apple”: those services trusted your Apple ID to log you in, so check them for recent activity.

If the intruder also got into your email, phone carrier account or bank, the problem may be bigger than one account. Our hub on what to do when your account was hacked covers the universal first steps, and if you think your iPhone itself is compromised, see our guide for when your phone has been hacked.

A worked example

This is an illustrative scenario, not a real client. Marisol gets a text that looks like it’s from Apple, saying her account is locked and linking to a sign-in page. She enters her Apple ID, password and the code sent to her phone. An hour later she gets an email saying a new phone number was added to her account.

Her iPhone is still signed in, so she goes straight to her account settings on the phone. She changes her password using her device passcode, removes the unfamiliar phone number and a laptop she doesn’t own from her devices list, and checks her purchase history. She finds a gift card purchase she didn’t make, reports it to Apple and calls her card issuer.

Because she stores passwords in iCloud Keychain, she then changes her email and bank passwords, and turns on Stolen Device Protection. She deletes the phishing text and reports it as junk. The whole process takes about an evening, mainly because she still had a trusted device.

What not to do

• Don’t pay a “recovery service”. Nobody outside Apple can shortcut account recovery, and people offering to do so on social media are usually scammers.
• Don’t start several recovery requests. It can reset or delay the process.
• Don’t keep using a signed-in device during account recovery unless Apple’s instructions say otherwise, since that can cancel the request.
• Don’t reuse your old password or a variation of it.
• Don’t ignore the email account. If the attacker still controls your email, they can reset your Apple ID again.
• Don’t call numbers shown in Lost Mode messages or pop-ups. Contact Apple through channels you find yourself.

How to stop it happening again

Apple accounts created in recent years use two-factor authentication by default, which stops most password-only attacks. What still works for criminals is tricking you into handing over a code, or getting into the phone number or email the account depends on.

• Use a unique, long password for your Apple account, stored in a password manager.
• Keep at least two trusted phone numbers you control, such as your own and a partner’s.
• Consider a recovery contact: a trusted person who can help you get a code if you’re locked out. They can’t see your data.
• Consider a recovery key for stronger security, but only if you’ll store it safely. With a recovery key set, you generally need it (or a trusted device) to reset your password, and losing both could lock you out permanently.
• Consider physical security keys, which Apple supports for signing in, if you’re a higher-risk target.
• Ask your mobile carrier to add a PIN or port-out protection so no one can move your number to their SIM.
• Before you sell, trade in or give away an iPhone, remove your Apple ID from it so the device is no longer linked to your account.
• Check whether your email appears in known breaches using a tool like Have I Been Pwned, and change any reused passwords.

If the hacker used your iMessage, iCloud photos or social accounts to post or send something damaging in your name, the fallout can reach beyond the account itself. Our personal reputation management service helps when harmful content or impersonation shows up when people search for you.

Frequently asked questions

How do I know if my Apple ID was hacked?

Look for Apple emails about changes you didn’t make, unfamiliar devices in your devices list, purchases you don’t recognize, or being signed out of iCloud. Check your account settings on a device you trust rather than clicking links in messages, since fake Apple alerts are common.

How long does Apple account recovery take?

It varies. Apple uses a waiting period on purpose to protect your account, and the length depends on how much account information you can verify. It can range from a day or so to longer, and Apple sends updates to the contact details you provide.

Can someone hack my Apple ID if I have two-factor authentication?

It’s much harder, but not impossible. Most successful attacks trick the owner into sharing a verification code on a fake page or over the phone, or take over the trusted phone number through a SIM swap. Never share codes, and protect your carrier account with a PIN.

Will Apple refund purchases made on my hacked account?

Apple reviews unauthorized purchases case by case. Report them through Apple’s report-a-problem route or Apple Support as soon as possible, and contact your card issuer, who may be able to dispute the charge.

Should I delete my Apple ID after it was hacked?

Usually not. Deleting it can cost you purchases, photos and backups, and it doesn’t undo what the hacker saw. Recover it, secure it and change the passwords it may have exposed instead.