Yesterday I received a genuine-looking iPhone prompt asking me to approve a password reset. I selected "Don't Allow" because I hadn't requested it. Soon afterward, I received a large number of one-time codes by text and email. I immediately changed my password and tightened my account security, but the text codes started again today. Should I be worried that someone has access to my account, or are they simply repeatedly attempting the password-recovery process? What else should I check so I don't have to keep changing my password?
2 Answers
This can be an MFA-fatigue or password-reset attack. Someone may know your Apple Account email address and is repeatedly starting recovery attempts, hoping you eventually approve a prompt or share a code. The texts alone don’t prove they’re inside your account, and rejecting the prompt was the right thing to do. Check your account’s device list, trusted phone numbers, recovery contacts, sign-in history, and any unfamiliar security settings. Remove anything you don’t recognize, use a unique strong password, and never give a verification code to anyone. If the prompts or codes continue despite everything looking normal, contact Apple Support through its official website.
If there are no unknown devices, no unfamiliar trusted numbers, and you’re no longer seeing approval prompts, the attacker may only be triggering the public password-recovery flow from outside the account. You shouldn’t need to change your password every time a code arrives. Don’t enter or read the code to anyone, and be cautious of follow-up calls or messages claiming to be support. Also check your email account and mobile-provider account for suspicious activity, since control of either could weaken your security.

Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures