My Apple account appears to have been taken over. The attacker changed the date of birth, security questions, trusted phone number, and other account details, then enabled two-factor authentication. I can no longer sign in or get through the usual recovery process because it asks for information I don't control. There are no credit cards or other important payment details linked to the account, but I'd still like to recover it. What is the correct way to start account recovery, and what information might help prove that I'm the original owner?
2 Answers
Recovery may be extremely difficult once an attacker changes the trusted number and enables two-factor authentication. Support might not be able to override those protections, but it is still worth using Apple’s official Support app or support website and asking specifically about a compromised Apple Account. Be prepared for them to require strong proof of original ownership, and secure any devices and email accounts connected to the old account.
Since the trusted number and security details were changed, the standard recovery flow may not work. Contact Apple Support directly and explain that the entire account was taken over, rather than describing it as only a forgotten password. Gather any older account information, device serial numbers, original purchase receipts, and access to the email address previously associated with the account. Also secure that email account and change its password if you still can.
How do I reach Apple Support directly? I haven’t been able to find the right contact option.