Someone got into your Apple Account — and you can get it back.

Your Apple Account (also called your Apple ID or iCloud) is the account behind your iPhone, iPad, or Mac.

If yours was taken over, this guide shows you exactly what to do and what to tap, one calm step at a time.

You don't need to be good with tech.

Every tool here is free.

How to use this guide. Start at the top — the first steps matter most.

If you can still get into your account, Part 1 kicks the intruder out fast.

If you're locked out, jump to Part 2.

When Apple makes you wait, we tell you how long.

A note on the screen names.The buttons below match Apple's own instructions as of 2026.

Once in a while Apple renames a button.

If a word on your screen looks a little different, pick the closest match.

The "report it" steps in Part 5 are written for the United States — in other countries, use your country's version (we say where).

Which path are you on?

Can you still sign in? → Yes: change your password now (Part 1). → No, locked out: reset your password (Part 2).
Locked out, and resetting didn't work? Do you have any of these — a trusted device, your recovery key, or a recovery contact? → Yes: you can get back in fast (Step 5). → No: Account Recovery, a wait of several days (Step 6).
The worst case is a built-in waiting period, not a dead end.

Part 1 — The first hour (do these now)

Step 1. First: is this a real break-in, or just a scare?

Some messages try to scare you so you'll hand over your account.

Before you do anything, tell the two apart.

Signs of a real break-in (Apple's own list)

Your password suddenly stops working.

Apple emails or texts you about a change you didn't make.

A login code shows up that you didn't ask for.

You see messages you didn't send, or things deleted you didn't delete.

Your device gets locked, or "Lost Mode" turns on, and it wasn't you.

Signs it's just a scare (a trick)

Someone is pushingyou to act fast — an email, text, or call telling you to "verify," click a link, read back a code, tap a pop-up, or turn off a safety setting.

Meanwhile your account still works normally.

★ The one rule that stops almost every scam: Apple will neverask you to type your password, your device passcode, or a login code into a website — and never asks you to tap "Accept" on a pop-up or turn off a safety setting. If someone asks for any of that, it's a trick. Don't do it. And if no one actually broke in and your account still works, you're probably fine.

Step 2. If you can still get in, change your password right now.

This is the fastest way to lock the intruder out.

Pick a new password you've never used anywhere else.

iPhone or iPad: open Settings → tap your name (at the top) → Sign-In & Security → Change Password.
Mac: Apple menu → System Settings → your name → Sign-In & Security → Change Password.
On a computer or any browser: go to account.apple.com, sign in, open Sign-In and Security, then choose Password.

If your iPhone says "wait one hour," that's a safety feature called Stolen Device Protection (more in Part 6).

Can't change it because someone already changed it? Go to Part 2.

Step 3. Push the intruder off your other devices.

While you're still signed in:

On a computer, go to icloud.com/settings and click Sign Out Of All Browsers, then confirm. This boots anyone using your account in a web browser.
Then go to account.apple.com → Devices. Tap any device you don't recognize, then Remove from Account.

Changing your password in Step 2 also forces every other device to sign in again — so do Step 2 first.

Sources: Apple Support — "If you think your Apple Account has been compromised"; "Recognize and avoid social engineering schemes… phishing messages, phony support calls, and other scams"; "Change your Apple Account password"; "Keep your Apple Account secure."

Part 2 — Getting back in when you're locked out

Step 4. Get a new password.

Use whichever of these you can:

Your own device that's still signed in: Settings (or System Settings) → your name → Sign-In & Security → Change Password.
A login screen on a new device: tap "Forgot password or don't have an Apple Account?" → Sign in manually → Forgot password? (on Mac, click Forgot password).
Someone else's iPhone or iPad: open the free Apple Support app → scroll to Support Tools → Reset Password → Help Someone Else, then type your Apple Account email or phone number.
Any browser: go to iforgot.apple.com.

Step 5. Use what you have to prove it's really you.

Apple lets you back in faster if you have one of these.

Here's what each one means:

A trusted device — a phone, tablet, or Mac you already use and are signed in on. You can reset right there.
Your recovery key — a 28-character secret code you saved earlier as a backup. Type it in (plus a code Apple texts you).
A recovery contact — a person you picked before. Ask them to open Settings → their name → Sign-In & Security → Recovery Contacts, pick your name, tap Get Recovery Code, and read you the six digits.
None of the three? Go to Step 6.

Step 6. Account Recovery — the waiting path.

If you can't reset your password and you don't have a trusted device, a recovery key, or a recovery contact, this is Apple's official way back in.

Start it at iforgot.apple.com (tap Reset Password and follow the steps), or from Settings on a device.

It works — it just takes time on purpose, to keep the intruder out.

What the wait looks like:

Day 0 — you start it.
Within 3 days (72 hours) — Apple emails youthe exact day you'll get back in.
"Several days or longer" — you're back in. Apple does not promise an exact number of days.
You can't make it faster— even Apple Support can't speed it up. First turn off every other device that's signed in; if the account is being used during your request (including by the intruder), Apple cancels it automatically.

Step 7. The hardest case: the intruder changed your backup info.

This is the scary scenario — and it's covered too.

They changed your trusted phone number (the number where Apple texts your codes). Try to sign in; on the code screen choose "Didn't Get a Code?" or "Can't get to your devices?", then "Can't use [phone number]."If you can't reach any trusted number, start Account Recovery (Step 6). Apple says this "might take a few days or longer," and again can't be rushed.
Your account is locked or turned off.You might see "This Apple Account has been locked for security reasons." Reset your password, or tap Request Access right in the message (or go to iforgot.apple.com/unlock). If that's turned down, Apple's only options are to make a new Apple Account, or — if you have a receipt for the device — ask Apple to remove the device lock.
They changed your account's email address. There is no magic "undo" buttonfor this. Apple sends a warning when account details change, but the fix is the same: if you can still sign in, change your password right away; if not, use Account Recovery and try any other email addresses or phone numbers that might be on the account. (A "30 days" number you may read online is only a wait on reusing an old email — not a way to undo the change.)

⛔ If the intruder turned on a "recovery key": This is the one case where Apple may truly be unable to help. A recovery key is a 28-character backup code, and turning it on switches offApple's normal way of helping you recover. In Apple's exact words: "If you can't provide your recovery key, you'll be locked out of your account permanently."If you never set up a recovery key but the account now has one, that's a sign the intruder is in control — start Account Recovery right away and report it (Part 5) immediately.

What a real Apple person can and can't do — the honest truth:A real Apple advisor can point you to the right tool and check that it's you (sometimes with a short "Support PIN" code). But they cannot make the waiting period shorter, cannot get around a recovery key, and will never ask for your password or codes. Anyone who does ask for those is a scammer.

Sources: Apple Support — "If you forgot your Apple Account password"; "How to use account recovery when you can't reset your Apple Account password"; "Set up a recovery key"; "Set up a recovery contact"; "About trusted phone numbers and trusted devices"; "If your Apple Account is locked, not active, or disabled"; "Change your Apple Account primary email address."

Part 3 — You're back in: lock the door

Do these in order so the intruder can't return.

Set a brand-new strong passwordyou've never used anywhere else (same path as Step 2).
Sign out everywhere: icloud.com/settings → Sign Out Of All Browsers → Sign Out.
Check your account details: at account.apple.com → Sign-In and Security, look at your name, emails, and phone numbers. Delete anything you don't recognize. Then ask your email company and phone company to make sure no extra address, number, or text-forwarding was secretly added in your name.
Fix your two-step login (the codes Apple sends you): Settings → your name → Sign-In & Security → Two-Factor Authentication. Add a phone number that's yours (Add a Trusted Phone Number), then remove any number you don't know (Remove from Account). You must keep at least one.
Remove devices you don't know: Settings → your name (scroll to the device list), or account.apple.com → Devices → pick the strange one → Remove from Account.
Check the recovery key: Sign-In & Security → Recovery Key. If you never set one up but it's switched on, turn it off (that brings back normal recovery), then make a fresh one only you have — and keep it somewhere safe.
Check your recovery contacts: same menu → Recovery Contacts. Remove anyone you didn't add, then add a person you trust.

Sources: Apple Support — "If you think your Apple Account has been compromised"; "Two-factor authentication for Apple Account"; "Check your Apple Account device list"; "Set up a recovery key"; "Set up a recovery contact."

Part 4 — Undo what they did

Step 8. Things they bought, and subscriptions.

See a charge you didn't make?

Go to reportaproblem.apple.com, sign in, choose "I'd like to" → "Request a refund," pick a reason, choose the item, and send it.

Check on it at reportaproblem.apple.com/status (it takes about 24–48 hours; rules vary by country).

To stop a subscription the intruder started: Settings → your name → Subscriptions → pick it → Cancel Subscription.

If a charge says "apple.com/bill" and you share with family, check whether a family member bought it.

Step 9. Apple Pay, Apple Card, and Apple Cash.

These are Apple's ways to pay.

They're mostly in the United States.

Apple Card (a credit card, run by a bank called Goldman Sachs): open Wallet → Apple Card → tap the charge → Report an Issue → "I want to report a compromised card and request a replacement."Apple says "You won't be liable for any unauthorized transactions" — meaning you don't have to pay for charges you didn't make.
Apple Cash (sending money to people, run by Green Dot Bank): first lock down your Apple Account, then call the Apple Cash team at 877-233-8552. To stop a payment that hasn't gone through yet: Wallet → Apple Cash → the payment → Cancel Payment. (It works in the 50 states, D.C., and Puerto Rico.)
Any other card in Apple Pay:call that card's own bank to report the charge.

Step 10. "Find My" tricks (locking or tracking your device).

Turn off Lost Mode (a setting that locks the device and shows a message): go to icloud.com/find, sign in, pick the device, choose Lost → Stop Lost Mode (or just type your passcode on the device).
Remove a device you no longer have: icloud.com/find → pick it → Remove This Device. If it's offline, the lock comes off right away and it leaves Find My after 30 days. One catch: if that device turns back on within 30 days while still signed in, it can come back and re-lock — so change your password first.
Unlock your own device: turn off Find My on it (Settings → your name → Find My) — that removes the device lock automatically.

Step 11. Screen Time locks.

Screen Time is the iPhone setting that limits apps — and it has its own passcode.

If the intruder set limits or a passcode: Settings → Screen Time → Change Screen Time Passcode (tap it again) → type the Apple Account email and password that was used to set it up.

Important: if they set it up under their ownApple Account, this won't work, and you may need to erase and restore the device after your account is fully safe — back up your stuff first if you can.

Sources: Apple Support — "Request a refund for apps or content"; "Cancel a subscription from Apple"; "Get help with charges from apple.com/bill"; "How to report a transaction issue or dispute a charge to your Apple Card"; "If you have an issue with an Apple Cash transaction"; "Use Lost Mode in Find Devices on iCloud.com"; "Remove a device from Find Devices on iCloud.com"; "How to remove Activation Lock"; "If you forgot the Screen Time passcode for an iPhone or iPad."

Part 5 — Tell someone (report it)

Reporting won't unlock your account — but it builds a record, helps stop the criminal, and you may need it later.

Tell Apple. Forward scam emails to reportphishing@apple.com. Tap Report Junk under a scam iMessage. Email a screenshot of a scam FaceTime call to reportfacetimefraud@apple.com.
FTC — report fraud (United States). Go to reportfraud.ftc.gov and click Report Now. The FTC says: "We can't resolve your individual report, but we use reports to investigate and bring cases." Your report is shared with more than 2,000 law-enforcement partners.
FTC — identity theft (United States). If someone is using your name or info (not just the account), go to IdentityTheft.gov or call 1-877-438-4338. It makes you an official "Identity Theft Report" and a step-by-step plan. That one report is "sufficient documentation to resolve issues with the credit bureaus and most companies."
FBI — IC3 (United States). For internet crime, file at ic3.gov → File a Complaint. Have ready: your contact info, money details (amounts, dates, where it went), anything you know about the criminal, and email headers if you have them. IC3 passes complaints to law enforcement but doesn't work your case directly or give status updates.
Local police.Your IdentityTheft.gov report already counts as your official police-style report, so you usually don't need one. File a police report anyway if you know who did it, or if a company specifically asks — bring a copy of your FTC report, and ask the police for a copy of theirs.
Outside the United States?Use your country's version — for example the UK's Action Fraud, the Canadian Anti-Fraud Centre, or Australia's Scamwatch.

Sources: Apple Support — "Recognize and avoid… scams." FTC — ReportFraud.ftc.gov; IdentityTheft.gov; "Report Identity Theft." FBI — Internet Crime Complaint Center (ic3.gov).

Part 6 — Stop it from happening again

A short checklist, all from Apple's own advice:

Use a strong password you don't use anywhere else, and keep two-step loginturned on (so a password alone isn't enough to get in).
Turn on Stolen Device Protection (iPhone): Settings → Face ID & Passcode → Stolen Device Protection. When you're away from home or work, it adds a one-hour wait plus a face or fingerprint check before big changes — so even a thief who saw you type your passcode can't lock you out. Needs iOS 17.3 or newer, and you must turn it on before a phone is lost.
Save a recovery key and add one or two recovery contacts so you always have a way back in — but keep the recovery key somewhere safe, because losing it (and your devices) can lock you out for good.
Try passkeys (a newer, safer way to sign in with your face or fingerprint instead of a password), and for the strongest protection, hardware security keys (small physical keys you plug in or tap).
Never read a login code out loud to anyone — and remember, Apple never asks for your password or codes.

Sources: Apple Support — "Security and your Apple Account"; "About Stolen Device Protection for iPhone"; "Set up a recovery key"; "Set up a recovery contact"; "About the security of passkeys"; "About Security Keys for Apple Account."

Related recovery guides

This guide is part of a series.

If a different account was hit:

If the break-in goes deeper than one account — drained funds, stolen identity, or an attacker who keeps getting back in — these SleuthX services can help:

A note from SleuthX

This guide is free, and the steps above are everything most people need to get their account back on their own.

If your case is unusually tangled — Account Recovery keeps failing, you've lost every way to prove it's you, or the break-in looks like part of a bigger fraud (drained accounts, stolen identity, blackmail) — SleuthX investigates account-takeover cases and can help.

We're a digital-forensics firm; reaching out is optional and there's no charge to ask.

You can find us at sleuthx.ai or email quinn@sleuthx.ai.

Either way — you've got this.

Work the steps in order, and don't share your codes with anyone.

Where this comes from

Every step, screen name, and timeline above comes from current official sources — listed here so you (or a grown-up helping you) can read more or check anything.

Apple Support (support.apple.com)

U.S. Government

This guide is informational and is not legal advice. SleuthX is an independent digital-forensics company and is not affiliated with, endorsed by, or sponsored by Apple Inc. "Apple," "Apple ID," "Apple Account," "iCloud," "iPhone," "Apple Pay," "Apple Card," and "Apple Cash" are trademarks of Apple Inc. Steps and timelines reflect official sources current as of June 2026 and may change. © 2026 SleuthX, Inc.