TL;DR: Apple says to change your Apple Account password, remove unrecognized devices and correct security info at account.apple.com, then turn on two-factor authentication. If you are locked out, use iforgot.apple.com and expect a waiting period.

👉 Check my digital footprint — free 30-second check →

Apple publishes a single checklist for a compromised Apple Account, plus separate pages for password reset, two-factor authentication and recovery methods. This guide follows those pages.

Signs Apple lists

What to do if you can still sign in

1. Change your Apple Account password to a strong, unique one. If you cannot, use the password reset process.

2. On account.apple.com, correct any personal or security information you do not recognize.

3. Remove unrecognized devices under Devices.

4. Verify that you control the email addresses and phone numbers on the account with their providers.

If you are locked out

Visit iforgot.apple.com for account recovery. Apple says a waiting period may apply before you regain access, though it does not state how long. With a trusted device already signed in to your account and protected by a passcode or password, go to Settings, then your name, then Sign-In & Security, then Change Password. If Stolen Device Protection is on, Apple says you might be required to wait one hour before changing your password or other critical security settings.

Without a trusted device, Apple describes three routes: borrow an Apple device and use the Apple Support app, reset at iforgot.apple.com, or choose "Forgot password or don't have an Apple Account?" during new-device setup. You need your Apple Account email or phone number, and information entered on a borrowed device is not stored on it.

How two-factor authentication works

Apple says two-factor authentication needs your password plus a six-digit verification code shown on trusted devices or sent to a trusted phone number. It is the default for most accounts, and Apple Pay and Sign in with Apple require it. If an account was created with it, it cannot be removed. After the first sign-in, a verified device does not need a code again unless you sign out completely, erase the device or change your password.

Recovery contacts and recovery keys

You can name up to five recovery contacts. A contact can give you a six-digit recovery code to reset your password, and for people using Advanced Data Protection can help regain access to end-to-end encrypted iCloud data. Setup is under Settings, your name, Sign-In & Security, Recovery Contacts. A recovery key is a 28-character code used with a trusted phone number and an Apple device. Apple says recovery methods are never shared with or known to Apple, and that at least one alternative (contact or key) must be set up before enabling Advanced Data Protection.

After you recover

Apple recommends confirming the correct Apple Account is signed in on all devices, enabling two-factor authentication, using Security Keys, turning on Stolen Device Protection on iPhone, and protecting devices with passcodes. Your Apple ID email is often the door to other accounts, so also read the hacked email account guide, the Google account guide and how to set up two-factor authentication.

A free digital footprint check shows whether the email tied to your Apple Account appears in leaked data.

Frequently Asked Questions

What are signs my Apple Account is compromised?

Apple lists unrecognized notifications, unsolicited two-factor codes, unauthorized messages or purchases, unrecognized devices, a password that no longer works and a device locked by someone else.

Where do I recover a locked Apple Account?

Apple points to iforgot.apple.com. A waiting period may apply, and Apple does not state its length.

What is Stolen Device Protection's delay?

Apple says you might be required to wait one hour before changing your password or other critical security settings.

How many recovery contacts can I add?

Up to five.

Can I turn off two-factor authentication?

Apple says that if an account was created with two-factor authentication, it cannot be removed.

Sources

Related Reading