I've used the same Apple Account for roughly 12 years. Recently, I received an unexpected Apple Account verification code, followed by alerts saying that a sound was played on my iPhone, Find My was disabled, a new recovery key was enabled, my payment cards were removed from Apple Wallet, an unfamiliar trusted phone number was added, my password was changed, and I was removed from my iCloud family group and calendar. I can no longer sign in normally.
Apple Support told me that the new recovery key prevents them from restoring access and suggested creating a new Apple Account, even though I'm still signed in on my iPhone and computer. I have already changed passwords elsewhere, canceled my cards, backed up my photos, and taken other security precautions. However, photo syncing was disabled, and I'm worried the person who took over the account may still be able to access my iCloud data.
I had two-factor authentication enabled, which makes this especially confusing because I received the verification code but did not request it. Is there any legitimate recovery option I may have missed, or a way to remove the intruder and regain control of my original account?
1 Answer
If someone changed the account password, added their own trusted number, and generated a new recovery key, recovery may be extremely difficult. Apple generally treats the recovery key as a security control that even support cannot bypass. If account recovery through Apple's official recovery process fails, creating a new account may ultimately be the only option. Keep any devices that are still signed in offline or carefully secured, preserve your backups, and continue working only through official Apple support channels.
Two-factor authentication being enabled does not necessarily mean the attacker obtained the code directly from Apple. They may have gained access through a compromised device, a reused password, a convincing phishing attempt, a compromised phone number, or an already trusted session. Change passwords from a known-clean device and contact your mobile carrier to confirm that no unauthorized SIM or number transfer occurred.