iOS · Recovery Guide

How to Tell If Your Apple ID Has Been Compromised (iPhone)

Spotting the signs of a compromised Apple ID early can prevent further security issues and help you regain control of your account.

Review Your Apple ID Account Activity

Unexpected changes in your account data are often the first indication that something is wrong. Regularly check your Apple ID settings for anything out of the ordinary.

• Open Settings, tap your name at the top, and select Sign-In & Security. Look for any unknown devices under WHERE YOU'RE SIGNED IN.
• Still in Sign-In & Security, check your trusted phone numbers and email addresses. An attacker might add their own to receive verification codes.
• Go to Settings, tap your name, then Payment & Shipping. Look for unfamiliar payment methods or shipping addresses.

Check for Unfamiliar Charges or Downloads

Unauthorised purchases or app downloads can be a clear sign that someone else has access to your Apple ID.

• On your iPhone, go to Settings, tap your name, then Media & Purchases, and select View Account. Review your Purchase History for any unfamiliar items.
• Check your email inbox (including spam folders) for receipts from Apple for purchases you don't remember making.
• Look through your purchased apps in the App Store by tapping your profile picture, then Purchased. See if there are any apps you didn't download.

Observe Changes in Account Notifications and Communication

Attackers often try to suppress notifications or divert communication to avoid detection. Be alert for any unusual changes in how Apple communicates with you.

• Check your email for official Apple notifications about changes to your Apple ID, such as password resets or sign-ins from new devices that you didn't initiate.
• Be wary of emails or messages asking you to verify your Apple ID or click suspicious links. These could be phishing attempts.
• If you stop receiving expected security codes or account-related emails from Apple, it could indicate that your contact information has been altered.

Monitor Device Activity and Performance

A compromised Apple ID can sometimes manifest through changes in your device's behaviour, even if you haven't directly observed account changes.

• Look for apps you don't recognise on your home screen or in your App Library. They might have been installed by someone else.
• Notice if your iPhone's battery life suddenly drains much faster than usual, or if your data usage has unexpectedly increased. This could be a sign of unauthorised background activity.
• Check Settings → Privacy & Security → Safety Check. If you are concerned, you can quickly review who has access to your information.
• Observe if your iPhone is performing slower than usual or if applications are crashing frequently without explanation.