An old, mostly unused Apple Account was compromised twice. The attacker changed the date of birth, password, and security questions, and later managed to disable two-factor authentication and restore the previous security settings. I recovered the account through Apple's device-recovery process, changed the password, updated the email address, enabled two-factor authentication, generated a recovery key, and checked the device list. No unknown devices appeared; only devices I personally used during recovery were listed. I also secured the email account associated with it.
I have now requested permanent deletion of the Apple Account. An old iPhone 7 Plus is still signed in and was added as a trusted device, although Find My was disabled. I would like to keep the phone as an emergency replacement, not continue using the compromised account on it. I'm concerned that signing out now could remove an important trusted device, but leaving it signed in until deletion might cause Activation Lock or leave the phone unusable after the account disappears.
What is the safest approach? Should I sign out of the old iPhone before the account is deleted? Could the phone become locked if it remains signed in during deletion, and can a recovery key and two-factor authentication still be bypassed?
3 Answers
A recovery key is useful, but it is not a substitute for securing every recovery path. Someone who still controls a trusted device, trusted phone number, email account, or an active session might be able to interfere with recovery. Remove anything unfamiliar, use unique passwords, avoid links in unexpected messages, and contact Apple again through an official support channel if the deletion fails another time. The repeated changes could have resulted from phishing, an exposed old password, or a compromised recovery session, so it is worth reviewing all of those possibilities.
The email account connected to the Apple Account needs to be treated as part of the compromise, even if you saw no evidence that it was accessed. Change its password, enable two-factor authentication there as well, review forwarding rules and recovery methods, and sign out any sessions you do not recognize. Also check your other Apple devices and the account’s device and trusted-number lists independently through Apple’s official website or Settings.
Sign out of the Apple Account on the iPhone before the deletion completes. Account deletion instructions generally require signing out of every device first; otherwise the phone may remain associated with an account that no longer exists and could become difficult or impossible to activate or remove from Activation Lock. Since Find My is already disabled, sign out completely and verify that the phone reaches the normal setup or local-use state afterward.
That was my main concern, so I signed out rather than risk having the phone tied to an account that gets deleted. I’m hoping the recovery key and the updated account details keep the attacker out until deletion finishes.
The fact that no unfamiliar devices appeared does not prove there was no unauthorized access. Account settings or recovery methods may have been changed without a device remaining visibly listed, so securing the email and every trusted recovery method is important.