My old Apple Account was compromised even though I changed the password and enabled two-factor authentication. The attacker changed my date of birth, security questions, and later disabled two-factor authentication, but no unfamiliar devices ever appeared in the account. I recovered access again, changed the password and email address, enabled two-factor authentication, created a recovery key, and requested permanent account deletion.
I temporarily signed the account into an old iPhone 7 Plus, which became a trusted device. Find My was disabled, but the phone is still signed in. I do not need to use it immediately; I want to keep it as an emergency replacement phone. Since account deletion is pending, I am unsure whether I should leave the iPhone signed in as a trusted device or sign out now.
Could leaving it signed in cause activation or usability problems after the account is deleted? Could signing out make it harder to protect the account? I have also secured the email address associated with the account and want to know whether the new password, two-factor authentication, and recovery key are enough to prevent the attacker from disabling those protections again. What would be the safest way to preserve the iPhone for future use while preventing further access to the account?
4 Answers
The fact that no unknown devices appeared does not prove there was no unauthorized access. The compromise could have involved the email account, a recovery method, a stolen session, or account-recovery abuse rather than a device visibly listed in the account. Use only the official account-management site or Apple Support, avoid links in unexpected emails, and ask Apple to investigate the repeated changes and the failed deletion request.
Sign out of the Apple Account on every device you own before the deletion finishes. Account deletion instructions generally require this, and leaving a device associated with an account that no longer exists can create activation-lock or sign-out problems. Since Find My is already disabled, signing out now is the safer choice for preserving the iPhone as a usable emergency phone.
A recovery key is useful, but it is not a substitute for securing every recovery path. Keep it offline and never share it, verify the trusted phone numbers and email addresses, remove anything unfamiliar, and check your current devices for unexpected account associations. Once the old phone is signed out and Find My is off, it should not be left dependent on the soon-to-be-deleted account.
Make sure the email account connected to the Apple Account is secured independently, including a unique password and two-factor authentication. Also review every device and trusted phone number associated with the account. If the attacker can access the email or another trusted recovery method, changing the Apple password alone may not be enough.
That was my main concern. I signed out of the old iPhone so it would not remain tied to the account if deletion succeeds.