Hacked Apple Account: How to Recover It (2026)

Quick answer: If you can still sign in, change your Apple Account password straight away and remove any device you do not recognise at account.apple.com. If you are locked out, go to iforgot.apple.com to reset your password or start Apple's account recovery. Recovery can take several days, and Apple Support cannot make it faster.

Apple ID is now called Apple Account, and you can still sign in with the same email address or phone number and password. Everything below comes from Apple's own help pages.

What to do in 3 steps

1. Change your password. Use a strong password you do not use anywhere else. The easiest and most secure way is on your iPhone or another trusted device that is already signed in to your Apple Account.
2. Remove devices you do not recognise. Go to account.apple.com, select Devices, and remove any device you do not recognise.
3. Check that you control your email and phone number. Apple says to check with your email provider and your mobile carrier that you control every email address and phone number linked to your Apple Account, including that SMS forwarding has not been set up on your number.

Signs your Apple Account may be compromised

Apple lists these signs: activity notifications you do not recognise, a two-factor code you did not ask for, messages you did not send, trusted devices or purchases you do not recognise, a password that no longer works, or a device locked or put in Lost Mode by someone else.

If you can still sign in: secure the account now

• On iPhone or iPad: open Settings, tap your name, tap Sign-In & Security, then tap Change Password. If you have other devices signed in, Apple gives you the option Remove Other Devices, which makes them sign in again.
• On a Mac: choose Apple menu, then System Settings, click your name, click Sign-In & Security, then click Change Password.
• On the web: go to account.apple.com, sign in, then go to Sign-In and Security and choose Password.
• You might be told to wait one hour before changing your password. Apple links this security delay to Stolen Device Protection.
• Check which Apple Account is signed in on each device, including FaceTime, Messages, Media & Purchases, Mail and Calendar.
• Make sure two-factor authentication is on. Apple says most accounts already use it. On a device, go to Settings (System Settings on a Mac), choose your name, then Sign-In & Security. Apple says it cannot be removed if your account was created with it.

If you are locked out but have a trusted device, number or email

1. On the sign-in screen, choose "Forgot password?" and follow the onscreen instructions. Apple says this leads you to a trusted device, asks for recovery factors, or starts a waiting period.
2. If you are already signed in on an iPhone, iPad, Apple Watch, Apple Vision Pro or Mac, try changing your password on that device first. A trusted device is one where you have already signed in with two-factor authentication.
3. Without a trusted device, Apple may ask for recovery factors such as your trusted phone number, a code from a recovery contact you set up earlier, your Apple Account email address, or a recovery key or security key if you set one up.
4. If none of these work, request account recovery (next section).

If you will have your trusted device or trusted phone number back soon, Apple says to wait for it, because you will regain access more quickly that way.

If the attacker changed your password, email or phone

Apple says that if someone else has already changed your password, you should reset it using Apple's password reset steps. If you still cannot reset it or sign in, go to iforgot.apple.com to start account recovery and regain access after a waiting period. Apple says to use Safari for this.

The Apple pages we read do not describe an ID upload or video selfie step. Follow only what iforgot.apple.com asks you for.

What to expect, as Apple describes it:

• A confirmation email (or iMessage for accounts that use only a phone number) tells you the date and time you can expect to regain access. It arrives within 72 hours of starting recovery. If it does not, Apple says to wait the full 72 hours, check spam and junk, then check iforgot.apple.com.
• The wait "might take several days or longer". Apple says it is fixed, and Apple Support cannot shorten it, so do not contact Support to try.
• Do not submit another request. Apple says it will not speed things up and might extend the wait.
• If you started on the web, Apple says to turn off all your Apple devices during the wait. If you started on an iPhone, iPad or Mac, Apple says you can keep using that same device (its page lists the software versions this applies to).
• Apart from that, using an Apple device that is signed in to your account cancels your recovery request. If you find such a device, Apple says you can change your password on it instead: the recovery request is cancelled and you can sign in with the new password.
• When the wait is over, Apple contacts you by email and by text or automated call. If you do not get it, Apple says you can go to apple.com/recover after the time in your confirmation email.
• If you did not ask for account recovery, Apple says someone may be trying to get into your account. Use the cancellation link in the confirmation email straight away, then consider changing your password and reviewing your account security.
• To check progress, enter the same email address and phone number on iforgot.apple.com that you used to start. Different details might extend the wait.

If you have no device of your own, Apple says you can use its Support App on a borrowed device or at an Apple Store: open the app, scroll to Support Tools, select Reset Password, then "Help Someone Else". Apple says what you enter is not stored on the borrowed device.

If the account is locked, not active or disabled

Apple explains these messages on its page If your Apple Account is locked, not active, or disabled:

• "Disabled for security reasons" or "locked for security reasons": Apple says the account locked itself to protect you, for example after a password or other details were entered wrongly too many times. To regain access, reset your password (see above).
• "Locked" or "not active": Apple says you might be able to tap Request Access in the alert, or request access at iforgot.apple.com/unlock. Apple says such a request might be denied. If you cannot regain access, the options it lists are creating a new Apple Account or, if you need help removing Activation Lock from a device and have proof of purchase, starting an Activation Lock support request.
• "Your Media & Purchases account has been disabled": Apple says you might be able to tap Continue in the alert, or use "Request reactivation", which is also listed on Apple's Contact Apple Support page.

After you are back in

• Review your purchase history at reportaproblem.apple.com for charges you do not recognise. Apple says to contact Apple Support if you still cannot identify one.
• Check Messages, Mail and other apps for anything you did not send, and tell friends and family not to trust any odd message sent in your name.
• Consider Apple's extra protections: Security Keys for Apple Account and, on iPhone, Stolen Device Protection (Settings, then Face ID & Passcode, or Touch ID & Passcode). Apple says it must be turned on before a device is lost or stolen.
• If your email account was also taken over, secure that first, because Apple tells you to make sure you control every email address linked to your Apple Account.
• If money was taken, see what to do right after a scam and report it to your bank and to the police.

Warning: fake "recovery" services and fake Apple Support

Do not pay anyone who offers to get your Apple Account back, and do not give anyone who contacts you control of your account or devices. Apple's scam page describes scammers who claim someone broke into your iCloud account and say they want to help. Apple says it never asks you to sign in to any website, to tap Accept in the two-factor authentication dialog, or to give your password, device passcode or two-factor code. It also says it never asks you to turn off a security feature such as two-factor authentication or Stolen Device Protection. If a call claims to be from Apple, Apple says to hang up and contact Apple through its official support channels. To see how fund-recovery fraud works, read The Second Scam.

Apple says to forward a suspicious email that looks like it is from Apple to [email protected].

If you are being threatened or blackmailed

If someone with access to your photos or messages is threatening to share them, do not pay. See our sextortion and blackmail guide and report it to the police.

If it is a child's account

If the account belongs to a child or teenager, ask a parent or trusted adult to help. Apple says a parent or guardian can use their own trusted device to change the password of a Child Account in their Family Sharing group.

What Apple does not promise

The Apple pages we read give no fixed number of days for account recovery and no guarantee that every account can be recovered; Apple says a request to unlock a locked account might be denied. Apple does list phone and chat support by country on its Contact Apple Support page, but it says Apple Support cannot shorten the account recovery wait. Use only the contact options on Apple's own site, never a number from a search result or a message.

We checked the steps against Apple's own help pages on 26 October 2026; menus change, so follow the on-screen prompts if they differ.

Sources

• If you think your Apple Account has been compromised
• If you forgot your password and can't sign in to your Apple Account
• What to expect during account recovery
• If your Apple Account is locked, not active, or disabled
• Change your Apple Account password
• Two-factor authentication for Apple Account
• Recognize and avoid social engineering schemes
• About Stolen Device Protection for iPhone
• If you see 'apple.com/bill' on your billing statement
• Contact Apple Support

If you have been targeted, you are not alone. See our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.