How to Recover Your iCloud Mail Account After Being Hacked

    Step-by-step instructions for regaining access to your iCloud Mail using Apple's recovery tools, verifying your identity, and securing your account once you're back in.

    JDCS
    By Jordan Dickson · Reviewed by CSG Security Engineers

    Updated July 2026 · 9 min read

    Losing access to your iCloud Mail — or finding someone else inside your Apple ID — is alarming, but it's usually recoverable if you act quickly and methodically. Your iCloud Mail lives on your Apple ID, so getting back in means proving to Apple that you're the real owner. Here's how, fastest route first.
    Affiliate disclosure: if you sign up for a paid Proton plan through links on this page, CyberSecurityGuides may earn a commission at no extra cost to you. We only recommend tools we use and trust.

    Act quickly

    The sooner you start, the better your chances. Every hour gives an attacker more time to change your trusted phone number, recovery email and password — and Apple leans heavily on those to verify you. Begin from an Apple device you've used before if you possibly can.

    Start here: where can you still get in?

    How you get back in depends on whether you still have an Apple device signed in to your Apple ID. A trusted iPhone or iPad is by far the strongest route — Apple's two-factor security is built around your devices, so one you control can reset everything without the old password. If no device is left, you'll recover online. Work top to bottom.

    Don't assume the worst

    Plenty of people are still quietly signed in on a device they forgot about. If any of your Apple devices still has your account, you almost certainly have the fastest, most reliable way back — even if the password was already changed.

    A trusted Apple device

    iPhone or iPad still signed in — reset everything from Settings

    Recover online

    No device left? Reset and verify at iforgot.apple.com

    Path 1 — Still have a trusted iPhone or iPad?

    If any Apple device is still signed in to your Apple Account, that's your strongest route. Apple lets you reset your password right from a trusted device using just its passcode — never the old password — and then sign every other device out.
    1

    Check whether your iPhone is still signed in

    First, work out whether this iPhone or iPad is still signed in to your Apple Account — if it is, you can reset everything from the device itself, no password needed.

    Open Settings, tap your name at the very top (that's your Apple Account), then tap Sign-In & Security. What happens next tells you where you stand.

    9:41
    FaceTime
    Calendar
    Photos
    Camera
    Maps
    Clock
    Notes
    Settings

    iPhone home screen, tapping the Settings app, then tapping your name (Apple Account) at the top of Settings, then Sign-In & Security

    You'll see one of two things

    Still signed in
    9:41

    Email & Phone Numbers

    yourname@icloud.com

    Primary email

    Add Email or Phone Number

    These addresses and phone numbers can be used to sign in, verify your identity, and help recover your account.

    Security

    Change Password
    Two-Factor Authentication

    Your trusted devices and phone numbers are used to verify your identity when signing in.

    Recovery Methods

    Recovery ContactsSet Up
    Recovery KeyOff

    Regain access to your account and data if you forget your password or device passcode.

    Legacy ContactSet Up

    A legacy contact is someone you trust to have access to the data in your account after your death.

    Automatic VerificationOn
    OR
    Asked to re-verify
    9:41
    Apple Account
    Y

    Your Name

    yourname@icloud.com

    Personal Information
    Sign-In & Security
    Payment & Shipping
    Subscriptions
    iCloud
    Find My
    Media & Purchases

    Apple Account Verification

    Enter the password for “yourname@icloud.com” in Settings.

    Not Now
    Settings

    Two iPhone outcomes side by side: on the left Sign-In & Security opens because you're still signed in; on the right an Apple Account Verification alert appears over your account screen asking you to enter your password in Settings, with the Settings button highlighted

    • Sign-In & Security opens straight away? You're still signed in on this device — carry on to the next step.
    • Get an “Apple Account Verification” prompt instead? Your session has most likely been signed out by the attacker. You'll get back in via Path 2 below.

    No Apple device signed in?

    If none of your devices is signed in — or the attacker already signed them all out — don't keep trying here. Jump to Path 2 and recover online.
    Recover online instead (Path 2)
    2

    Set a new password with your device passcode

    Whichever route you took — Change Password or Forgot Password? — Apple verifies you with your device passcode, not the old one. Enter it, then set a long, unique new password. This signs the attacker out of the web and forces a fresh login everywhere.

    9:41

    Email & Phone Numbers

    yourname@icloud.com

    Primary email

    Add Email or Phone Number

    These addresses and phone numbers can be used to sign in, verify your identity, and help recover your account.

    Security

    Change Password
    Two-Factor Authentication

    Your trusted devices and phone numbers are used to verify your identity when signing in.

    Recovery Methods

    Recovery ContactsSet Up
    Recovery KeyOff

    Regain access to your account and data if you forget your password or device passcode.

    Legacy ContactSet Up

    A legacy contact is someone you trust to have access to the data in your account after your death.

    Automatic VerificationOn

    iPhone Sign-In & Security screen tapping Change Password, then entering the device passcode, then the New password sheet with New password and Retype Password fields and a Continue button

    If you use Stolen Device Protection

    With Stolen Device Protection turned on, an iPhone that's away from a familiar place (like home or work) will ask for Face ID or Touch ID — not your passcode — to change your password, and adds a one-hour security delay before the change goes through. At a familiar location your passcode usually works straight away. If you're locked out by the delay, just wait it out, then confirm with Face ID.
    3

    Sign out the attacker's other devices

    From Sign-In & Security, tap ← Apple Account and scroll down to the device list. Tap any device you don't recognise to open its Device Info, choose Remove from Account, then confirm Remove — that signs the attacker's device out for good.

    9:41

    Email & Phone Numbers

    yourname@icloud.com

    Primary email

    Add Email or Phone Number

    These addresses and phone numbers can be used to sign in, verify your identity, and help recover your account.

    Security

    Change Password
    Two-Factor Authentication

    Your trusted devices and phone numbers are used to verify your identity when signing in.

    Recovery Methods

    Recovery ContactsSet Up
    Recovery KeyOff

    Regain access to your account and data if you forget your password or device passcode.

    Legacy ContactSet Up

    A legacy contact is someone you trust to have access to the data in your account after your death.

    Automatic VerificationOn

    iPhone Sign-In & Security screen, tapping Back to the Apple Account screen, scrolling down to the device list, then tapping an unrecognised MacBook Air to open its detail screen with a red Remove from Account button

    Removing a device cuts off its 2FA codes

    Once a device is removed, it can no longer receive your two-factor verification codes or approve new sign-ins — which is exactly what you want for the attacker's device. Just make sure you keep at least one of your own trusted devices or a trusted phone number, so you can still get codes yourself.

    You're not done yet

    Locking the attacker out is only half the job. While they were in, they may have left quiet ways back — an app-specific password, an extra trusted number, a Mail forwarding rule. Sweep those next.
    Shut the back doors they left

    Path 2 — Signed out everywhere?

    No Apple device left signed in? You'll recover online at iforgot.apple.com — and the biggest thing you can do to make it work fast is to do it from an iPhone or iPad you've used before, on a network you normally use. Apple trusts a familiar device, so it can verify you in minutes rather than putting you through a multi-day wait. Have your trusted phone number, Recovery Key or recovery contact to hand too.
    1

    Go to iforgot.apple.com

    On an iPhone or iPad you've used before, open iforgot.apple.com in Safari and tap Reset password. Enter the email or phone number for your Apple Account and tap Continue. Because Apple recognises the device, it can verify you far more quickly than from a brand-new one.

    9:41
    iforgot.apple.com

    Forgotten password?

    Verify your account information to reset your password.

    Reset password

    Safari open at iforgot.apple.com on an iPhone, tapping Reset password, then typing your Apple Account email and tapping Continue

    2

    Verify it's you

    Apple offers whatever you set up — use the strongest you can: a code on a trusted device, a code to your trusted phone number, your 28-character Recovery Key, or a code from your Account Recovery Contact.

    3

    Set a new password

    Once you're verified, set a long, unique new password. If the attacker changed your trusted phone number, this is where you'll be prompted to add one you control.

    4

    No options work? Request Account Recovery

    If you can't verify any way, choose Can't access any of these? to start Account Recovery — an automated wait (often a few days) after which Apple lets you back in. Add a trusted phone number you control so Apple can reach you, and don't start a second request — it resets the timer.

    Getting in isn't the end

    Getting back in doesn't undo what the attacker changed while they were inside. Before you relax, sweep the account for the back doors they leave behind.
    Shut the back doors they left

    Shut the back doors they left open

    An intruder rarely just reads your mail — they set up ways back in. Sign in at appleid.apple.com (and open iCloud.com → Mail) and check each of these:
    • App-specific passwords. Sign-In & Security → App-Specific Passwords — revoke any you don't recognise. These bypass two-factor, so they're a favourite back door.
    • Trusted phone numbers. Remove any number that isn't yours.
    • Recovery email & Recovery Key. Confirm they're yours; regenerate the Recovery Key if you're unsure.
    • Mail rules & forwarding. At iCloud.com → Mail → Settings (gear) → Rules and Forwarding, delete anything you didn't create.
    • Aliases & Hide My Email. Remove any send-from addresses you don't recognise.

    Do it properly

    Our hardening guide walks through every one of these with screenshots, then turns on the protections that stop it happening again.
    Secure your iCloud Mail — step by step

    Troubleshooting & FAQs

    Which route should I try first?
    If any Apple device — iPhone or iPad — is still signed in to your Apple ID, start there (Path 1): you can reset your password from Settings using just the device passcode. No device left? Recover online at iforgot.apple.com (Path 2).
    The hacker changed my password — can I still get in?
    Yes, if you have a trusted Apple device. Settings → your name → Sign-In & Security → Change Password lets you set a new one with the device passcode, no old password needed. Otherwise reset at iforgot.apple.com using your trusted phone number or Recovery Key.
    The attacker changed my trusted phone number and I have no device.
    Use your Recovery Key or Account Recovery Contact if you set either up. If not, choose 'Can't access any of these?' at iforgot.apple.com to start Account Recovery — an automated wait of a few days, after which Apple lets you back in. Don't start a second request; it resets the timer.
    How long does Account Recovery take?
    Usually a few days. The wait is a safety feature — it gives Apple time to confirm the request is genuine and blocks an attacker from rushing you out. Adding a trusted phone number you control can speed things up.
    Do I have to pay to recover my account?
    No. Apple's recovery is free. Be wary of third-party 'account recovery services' — they can't do anything you can't do yourself, and many are scams.
    Is iCloud Mail recovery different from my Apple ID?
    They're the same thing — your iCloud Mail address is your Apple ID, so recovering one recovers the other. Everything here works whether you sign in on the web, the Mail app or an iPhone.

    What to do next

    If you got back in ✅

    You've reset your password and signed the attacker's sessions out — now make sure they can't walk back in.

    See what they changed

    Attackers leave footprints — rogue forwarding, extra aliases, app-specific passwords, tampered recovery settings. Check exactly what was touched.
    Spot the signs your iCloud was hacked

    Lock it down

    Turn on the protections that keep an attacker out for good — two-factor, a Recovery Key, clean trusted devices and recovery info.
    Secure your iCloud Mail account

    If you couldn't recover it ⚠️

    If recovery genuinely isn't working — no trusted device, no Recovery Key, and Account Recovery can't verify you — the account may be gone for good, and so is the address tied to it.
    So rebuild somewhere this is far less likely to happen again. You've just seen how much sits on a single inbox — make the new one private and hard to take over.

    Why Proton

    The full case for moving to an encrypted, privacy-first inbox — and how its design makes the takeover you just lived through far harder to repeat.
    Why switch to Proton Mail
    Proton Unlimited

    Rebuild on an inbox that's private by default

    Proton Mail, VPN, Pass and Drive in one encrypted, Swiss-based plan — end-to-end encrypted, no ads, no tracking.

    • End-to-end encrypted
    • Swiss-based, no ads
    • One plan, every app
    Get Proton Unlimited
    Proton Mail
    Proton VPN
    Proton Pass
    Proton Drive
    + Calendar
    With your new inbox set up, cut the lost account loose and contain the damage:
    • Move your other accounts over. Anywhere you used this iCloud address to sign in or reset passwords — banking, shopping, social media — change that password and set your new Proton address as the email and recovery contact.
    • Warn your contacts. Tell friends and family that messages from the old account may not be you, and to ignore requests for money, codes or links.
    • Watch for misuse. Turn on alerts where you can and keep an eye on anything tied to the old address.

    Any provider

    The recovery routes here work for any email account — answer a few questions and we'll build a step-by-step plan for your exact situation.
    Build my recovery plan
    Tags:
    Cloud Storage
    Email Security

    Was this guide helpful?

    Know someone who needs this? Send them the guide.

    JD

    Written by

    Jordan Dickson

    Founder, CyberSecurityGuides

    Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

    Reviewed by CSG Security Engineers

    More from Email Security

    No image

    Proton Drive: The Private, Encrypted Google Drive Alternative

    Proton Drive is end-to-end encrypted cloud storage — the private alternative to Google Drive and Dropbox.

    No image

    How to Update Your Email on Important Accounts

    Work through your key accounts and switch each one to your new Proton address — logins, bills and statements included.

    No image

    Phishing email examples: 8 real scams (with screenshots) and how to spot them

    Eight real phishing email patterns we see again and again, what tipped them off as fakes, and the simple 30-second habit that beats every one.