I've used the same Apple Account for about 12 years. Recently, I received an unexpected Apple verification code, followed by alerts saying that a sound was played on my iPhone, Find My was disabled, a new recovery key was enabled, my payment cards were removed from Apple Wallet, an unfamiliar trusted phone number was added, my password was changed, and I was removed from my iCloud Family group and calendar. I can no longer sign in normally.
Apple Support told me that the recovery key prevents them from bypassing the new security settings and suggested creating a new Apple Account, even though I'm still signed in on my iPhone and computer. I've changed passwords, cancelled my cards, secured my other accounts, and backed up my photos to an external drive. However, photo syncing was disabled, and I'm worried the person who took over the account may still have access to my iCloud data.
I had two-factor authentication enabled, which is why I received the unexpected verification-code text. Are there any legitimate recovery options left, such as using one of my still-trusted devices, or is the account permanently lost? I mainly want to regain control and remove the unauthorized person.
1 Answer
If someone changed the password, recovery key, and trusted phone number, Apple may treat those settings as the proof of account ownership. A recovery key is specifically designed to prevent account recovery without the key, so support often cannot simply override it. Secure any devices that are still signed in, preserve your photos and other data locally, change passwords for every related account, and make sure your email and phone carrier accounts are protected. You may need to create a new Apple Account if Apple’s official recovery process cannot verify you.
I did have two-factor authentication enabled, which is why I received the unexpected verification code. That’s what worries me most—I still don’t know how the attacker got far enough to change the recovery settings.