Review Your Apple ID Account Activity
Unexpected changes in your account data are often the first indication that something is wrong. Regularly check your Apple ID settings for anything out of the ordinary.
- Open
Settings, tap your name at the top, and selectSign-In & Security. Look for any unknown devices underWHERE YOU'RE SIGNED IN. - Still in
Sign-In & Security, check your trusted phone numbers and email addresses. An attacker might add their own to receive verification codes. - Go to
Settings, tap your name, thenPayment & Shipping. Look for unfamiliar payment methods or shipping addresses.
Tip
If you see a device you don't recognise, but it is not linked to unusual activity, it might be an old device you forgot to remove.
Check for Unfamiliar Charges or Downloads
Unauthorised purchases or app downloads can be a clear sign that someone else has access to your Apple ID.
- On your iPhone, go to
Settings, tap your name, thenMedia & Purchases, and selectView Account. Review yourPurchase Historyfor any unfamiliar items. - Check your email inbox (including spam folders) for receipts from Apple for purchases you don't remember making.
- Look through your purchased apps in the App Store by tapping your profile picture, then
Purchased. See if there are any apps you didn't download.
Important
Keep an eye on your bank statements as well. Fraudulent charges might appear there even if you don't see a corresponding Apple receipt immediately.
Observe Changes in Account Notifications and Communication
Attackers often try to suppress notifications or divert communication to avoid detection. Be alert for any unusual changes in how Apple communicates with you.
- Check your email for official Apple notifications about changes to your Apple ID, such as password resets or sign-ins from new devices that you didn't initiate.
- Be wary of emails or messages asking you to verify your Apple ID or click suspicious links. These could be phishing attempts.
- If you stop receiving expected security codes or account-related emails from Apple, it could indicate that your contact information has been altered.
Good to know
Apple will never ask you for your password, credit card number, or security code via email or text message.
Monitor Device Activity and Performance
A compromised Apple ID can sometimes manifest through changes in your device's behaviour, even if you haven't directly observed account changes.
- Look for apps you don't recognise on your home screen or in your App Library. They might have been installed by someone else.
- Notice if your iPhone's battery life suddenly drains much faster than usual, or if your data usage has unexpectedly increased. This could be a sign of unauthorised background activity.
- Check
Settings→Privacy & Security→Safety Check. If you are concerned, you can quickly review who has access to your information. - Observe if your iPhone is performing slower than usual or if applications are crashing frequently without explanation.
Tip
Regularly reviewing your app usage and understanding what's running on your device can help you spot anomalous activity quickly.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers