How to Fix a Hacked Apple Account (2026 Guide)

Your Apple Account is the key to almost everything in your digital life. It controls your messages, photos, iCloud backup, payment methods, your location in Find My, and more. If someone gains unauthorized access, the fallout can reach well beyond a single account.

The threat is real. Apple consistently ranks among the most targeted brands in phishing campaigns, accounting for roughly 9% of all brand phishing incidents globally in 2025 — making it the third most impersonated brand in the world.

If you think your account has been compromised, this guide walks you through how to spot the signs, recover access, and protect yourself going forward.

A quick note on terminology: In 2024, Apple officially renamed “Apple ID” to “Apple Account” with the launch of iOS 18. You’ll still see “Apple ID” used in some older settings menus and articles, but they refer to the same thing. We use the current name throughout this guide.

How Does an Apple Account Get Hacked?

Understanding how attackers typically gain access helps you close the door for good. Below are the 4 main ways hackers compromise Apple Accounts:

• Phishing emails and texts. The most common route by far. Scammers send convincing messages that appear to be from Apple, warning you of suspicious activity or asking you to verify your account. Clicking through takes you to a fake Apple login page that captures your credentials instantly.
• Credential stuffing. If you’ve used the same password across multiple services and one of those has suffered a data breach, attackers can use the leaked credentials to try logging into your Apple Account. This is one of the strongest arguments for a unique password on every account.
• Someone close to you knows your login credentials. Partners, family members, or close friends often know — or can easily guess — your Apple Account password, giving them access to anything you’ve synced to iCloud. This is more common than many people expect: Certo’s own research found that 42% of people had their accounts accessed by an ex following a breakup.
• iCloud monitoring spyware. Some commercial spyware services — including widely-used tools like mSpy — offer plans that work entirely through your iCloud account. If an attacker obtains your Apple Account credentials, they can use these services to view any data you’ve synced to iCloud: your messages, photos, location, contacts, calendar, and more.

Signs Your Apple Account Has Been Hacked

Apple does a reasonable job of alerting you to unusual account activity, but not every compromise comes with a clear warning. Here are the red flags to watch for.

• You receive a sign-in notification for a device you don’t recognize. Apple sends an alert whenever your account is signed in on a new device. If you get one and it wasn’t you, treat it as urgent.
• You receive a Two-Factor Authentication code you didn’t request. If a 6-digit verification code arrives on your device and you haven’t tried to sign in anywhere, someone else is attempting to access your account using your credentials.
• Your Apple Account password no longer works. Changing the victim’s password is one of the first things an attacker does. If your credentials suddenly fail, assume the worst and act quickly.
• Your iPhone has been put into Lost Mode. Lost Mode can be activated remotely via iCloud. Hackers sometimes use this deliberately to lock you out of your device, buying them more time to access data in your account.
• You notice unfamiliar devices in your account settings. Go to Settings > [Your Name] and scroll down to the list of devices signed in to your Apple Account. Any device you don’t recognize warrants immediate action.
• Purchases you didn’t make appear in your account. Unauthorized App Store purchases, subscriptions, or Apple Pay transactions are a strong sign someone else has been using your account.
• Your trusted phone number or email address has been changed. If a hacker changes your recovery details, regaining control becomes significantly harder. Check these at account.apple.com.
• Unexpected data appears — or disappears — in iCloud. Files, photos, or notes you didn’t create, or content that’s gone missing, can indicate unauthorized access.

How to Fix a Hacked Apple Account

The steps you need depend on whether you can still log in or whether you’ve been locked out entirely. Follow the path that matches your situation.

If You Still Have Access to Your Account

If you can still log in, you have a meaningful advantage. A hacker who hasn’t yet changed your password could do so at any time, so move fast.

Step 1: Change your Apple Account password immediately

Don’t wait. Change it before the window closes.

• On iPhone: Settings > [Your Name] > Sign-In & Security > Change Password.
• On a Mac: Apple Menu > System Settings > [Your Name] > Sign-In & Security > Change Password.
• On the web: Go to account.apple.com, sign in, and update your password under Sign-In & Security.

Use a strong, unique password — at least 12 characters, mixing upper and lowercase letters, numbers, and symbols. Never reuse a password from another service.

Fig 1. Changing the Apple Account password on iOS.

Step 2: Review and remove unknown devices

Devices added to your Apple Account could receive your messages or phone calls, view data synced with iCloud, and see your browsing history.

Scroll down the Devices list in Settings > [Your Name] and inspect every entry. Tap any device you don’t recognize and select Remove from Account. This signs it out immediately.

Fig 2. Reviewing connected devices.

Step 3: Verify your trusted contact information

A hacker may have quietly changed your trusted phone number or backup email to make future recovery difficult. Visit account.apple.com and check your details under Sign-In & Security. Update anything that isn’t right.

Step 4: Enable Two-Factor Authentication if it isn’t already on

Two-Factor Authentication (2FA) means that even if someone has your password, they also need physical access to one of your trusted devices to sign in. It’s one of the most effective safeguards against account takeover.

To turn on 2FA on iPhone:

1. Go to Settings > [Your Name] > Sign-In & Security (or Password & Security on some devices).
2. Tap Turn On Two-Factor Authentication and follow the on-screen steps.

If 2FA is already enabled, check that only your phone numbers and devices are listed as “Verify Using” — remove any you don’t recognize.

Fig 3. Turning on Two-Factor Authentication.

Step 5: Report and dispute unauthorized purchases

If you spot purchases you didn’t make, report them to Apple at reportaproblem.apple.com. Sign in, find the transactions, and select the option to report a problem. You can also review your full purchase history in the App Store under your account.

Step 6: Scan your iPhone for spyware

If someone had access to your Apple Account credentials, particularly in a situation involving a partner or someone close to you, there’s a real chance they may have also installed monitoring software directly onto your iPhone.

Unlike iCloud-based monitoring, this type of spyware can give an attacker access to far more — including calls, real-time location, messages, and even your microphone or camera.

In 2025, we analyzed over 580,000 phones for spyware and found that 6.87% of devices showed medium or high security threats. Many of those threats were hidden spyware and location tracking apps.

Certo AntiSpy is built specifically to detect these threats on iPhones. By connecting your device to a Mac or PC via USB, it can analyze areas of your phone that standard security apps simply can’t reach — catching spyware, surveillance tools, and vulnerabilities that would otherwise go completely undetected.

Fig 4. Certo AntiSpy detecting the spyware InstantSPY.

If You’re Locked Out of Your Account

Being completely locked out is more stressful, but recovery is possible. Work through these steps in order.

Step 1: Go to iforgot.apple.com

This is Apple’s official account recovery page. Enter your Apple Account email address and follow the prompts. Apple will ask you to verify your identity and, in many cases, will initiate an account recovery waiting period — which can last several days or longer.

This delay is deliberate. It’s a security measure designed to stop an attacker from completing a takeover by posing as you. It’s inconvenient, but it’s working in your favor.

Step 2: Use a Recovery Contact (if you set one up)

An Account Recovery Contact is a trusted person — typically a close friend or family member — who can generate a code that restores your access. If you set one up before the compromise, ask them to provide the code from their device.

Step 3: Use a Recovery Key (if you have one)

A Recovery Key is a 28-character code that can bypass the standard recovery waiting period entirely. If you generated one when you set up your account and stored it somewhere safe, use it at iforgot.apple.com to regain access immediately.

Step 4: Contact Apple Support

If none of the above options are available, reach out to Apple Support at support.apple.com. They can walk you through identity verification options to confirm the account is yours.

How to Secure Your Apple Account Going Forward

Once you have access again, don’t stop there. This is the moment to put the right safeguards in place — so that if someone tries again, they won’t get far.

Enable Advanced Data Protection

Advanced Data Protection encrypts your iCloud data end-to-end, meaning that even if an attacker gains entry to your account, the contents of your iCloud are effectively locked to them. Even Apple can’t access it.

Before enabling it, you’ll need Two-Factor Authentication already turned on, and at least one recovery method set up (either a Recovery Contact or a Recovery Key).

To enable it:

1. Go to Settings > [Your Name] > iCloud.
2. Scroll down to Advanced Data Protection and tap it.
3. Follow the prompts to turn it on.

Fig 5. Turning on Advanced Data Protection.

Important note: Advanced Data Protection may not be available in all regions.

Only Sync What You Actually Need

Advanced Data Protection secures what’s in iCloud — but it’s also worth thinking about how much you’re putting there in the first place. The less data synced to your account, the less there is to steal if someone does gain access.

Go to Settings > [Your Name] > iCloud and review the list of apps and services currently syncing. Toggle off anything you don’t genuinely need backed up online — things like messages, third-party app data, or notes you’ve got saved elsewhere are worth considering.

It takes two minutes and quietly reduces your exposure without changing how you use your phone day to day.

Turn on Stolen Device Protection

Stolen Device Protection was introduced in iOS 17.3. It’s designed to stop someone who has your iPhone and knows your passcode from immediately taking over your Apple Account.

With it on, changing critical account settings — including your Apple Account password — requires biometric authentication (Face ID or Touch ID) plus a one-hour delay when your phone is away from a familiar location like home or work. That hour gives you time to remotely lock or erase the device before damage is done.

To enable it:

1. Go to Settings > Face ID & Passcode (or Touch ID & Passcode).
2. Enter your passcode.
3. Scroll down and tap Stolen Device Protection, then toggle it on.

Fig 6. Turning on Stolen Device Protection.

Set Up an Account Recovery Contact

If this experience showed you anything, it’s the value of having a backup route into your account. A Recovery Contact means that if you’re ever locked out again, a trusted person can help you back in without the extended waiting period.

1. Go to Settings > [Your Name] > Sign-In & Security.
2. Tap Recovery Contacts.
3. Choose a trusted person and follow the prompts.

Fig 7. Adding a Recovery Contact.

Use a Unique Password and a Password Manager

If you’re reusing passwords across services, you’re one data breach away from another compromise. A password manager generates and stores a strong, unique password for every account — you only need to remember one.

iOS has a built-in Passwords app, or you can use a standalone tool. Either way, it’s one of the highest-value security habits you can build.

Stay Alert to Phishing

If your credentials ended up in an attacker’s hands, the most likely explanation is a convincing phishing email or text. A few rules that don’t change:

• Apple will never email you a link to reset your password unless you specifically requested it.
• Apple will never call you out of the blue about your account.
• Apple will never ask for your Two-Factor Authentication code over the phone or via email.

If you get a message that feels like it might be a fake Apple security alert, our guide on spotting phishing scams can help you tell the difference.

Keep iOS Updated

Apple regularly patches known security vulnerabilities through iOS updates. Certo’s 2025 analysis found that 39% of iOS devices didn’t have automatic updates enabled — leaving them exposed to vulnerabilities Apple had already fixed. Turn on automatic updates under Settings > General > Software Update > Automatic Updates.

Wrapping Up

Discovering your Apple Account has been compromised is unsettling. But the steps to recover and protect it are straightforward — and once they’re in place, your account is significantly harder to target.

If there’s one thing this guide makes clear, it’s that recovery is significantly harder than prevention. The account recovery waiting period alone can cost you days of access to your own account.

Two-Factor Authentication, Advanced Data Protection, and an Account Recovery Contact each take a few minutes to set up — but if something goes wrong, that combination is what determines whether you’re back in within the hour or waiting out the week.

Frequently Asked Questions

What can a hacker do with access to my Apple Account?

Quite a lot. With access to your Apple Account, someone can view any data synced to iCloud — including your messages, photos, notes, and contacts. They can track your location via Find My, make purchases through the App Store or via Apple Pay, and access your emails if you use an @icloud.com or @me.com address.

What they cannot do through the account alone is access your microphone or camera in real time, or listen to your calls. That level of access requires spyware installed directly on the device.

How long does Apple account recovery take when I’m locked out?

It varies, but can be several days or longer. Apple deliberately introduces a waiting period as a security measure — it’s designed to prevent an attacker from completing a takeover by claiming to be you. If you have a Recovery Contact or a Recovery Key set up, you can bypass the wait. Contacting Apple Support cannot shorten it; the delay is managed by Apple’s systems automatically.

My Apple Account was hacked — does that mean my iPhone was hacked too?

Not necessarily, but it depends on the circumstances. A compromised Apple Account and device-level spyware are two distinct threats. If your credentials were stolen through phishing or a data breach, your device itself may be completely fine. But if the person involved also had physical access to your iPhone at any point, it’s worth running a dedicated scan to be certain. The two can overlap, and each needs a different response.

Can I change my Apple Account email address after a hack?

Yes — and if the email address linked to your account was itself compromised, changing it is a sensible step. You can update your Apple Account email at appleid.apple.com under Sign-In & Security. Make sure the new address is secured with a strong, unique password and Two-Factor Authentication.