An Apple ID I created around 2014 had been unused for years, with no active devices or payment methods connected. In June, someone changed its password, account name, and security questions. The new questions are in Chinese and definitely weren't set by me.
I still control the email address associated with the Apple ID, so I can reset the password. My email account has a separate password and two-factor authentication, and I have no evidence that it was compromised. I also still possess my old Apple devices, which have been unused for years.
The problem is that Apple continues asking me for the altered security-question answers, so I can't fully regain access. Apple Support said the account may be unrecoverable. Whenever I receive a notification that the password changed, I reset it again through my email, but the other person eventually changes it back.
How can this keep happening if the other person doesn't control my email? Could they be using a separate recovery email or another legacy-account recovery method? Is there any way to remove my email address from the account or permanently stop the changes? I'm mainly trying to understand the technical explanation.
2 Answers
This sounds like an older account that used security questions and a separate recovery email instead of modern two-factor authentication. The Apple ID email and the recovery email may not be the same thing. Whoever controls the recovery email—or has another valid recovery route—could potentially reset the password and security questions, while you can still use the Apple ID email to reset the password temporarily. That would explain the repeated back-and-forth changes.
The account may have had two-factor authentication disabled, or it may have been created before two-factor authentication was available. In that case, the attacker might have obtained or guessed the old recovery information, while your access to the primary email only gives you partial control. Try the official account-recovery process and check whether it offers a way to reset both the password and security questions using a recovery email. If you no longer control that recovery address, Apple may not be able to remove your email without additional verification.
That distinction between the Apple ID email and the separate recovery email would explain why I can reset the password but still can’t get past the security questions.