What Happened After My Apple ID Was Stolen—and Answers to Common Questions

More than six months have passed since the painful story—and cleanup—of having my Apple ID stolen last year.

For the painful story and everything I did afterward, see: The Hassle of Having My Apple ID Stolen

During that time, I received many emails and Instagram messages asking questions or saying thank you.

I am genuinely glad the earlier post helped. If I replied slowly to some messages, please forgive me, Orz. Work has been a little too busy lately, Orz.

Background

If the previous post already explained the solution so clearly, why write another one?

After an Apple ID is stolen, many people naturally wonder what might happen to the account and the information inside it.

As someone who spent the past six months being thoroughly bothered by the aftermath, I wanted to use my own experience to show one of the many things that can happen after an Apple ID is stolen.

I also wanted to answer questions readers sent by email or direct message and fill in what the previous post did not cover.

Answers to Common Questions

Q1. When is changing the password enough, and when would I need to reset the phone?

If you still control the trusted phone number and can change the password, immediately replace it with a strong password that you do not reuse elsewhere. At the same time, review the personal and security information on the account, remove devices you do not recognize, and confirm with your email provider and mobile carrier that you still control your email address, phone number, and any text-message forwarding.

If someone has changed the password, or you can no longer sign in or reset it, resetting the phone is not your only option. Under Apple’s current process, try resetting the password first. If that still does not work, begin account recovery at iforgot.apple.com. Account recovery may take several days or longer; the actual timing is whatever Apple shows for your case.

Keep three things separate: regaining access to the Apple Account, removing Activation Lock from a device, and erasing or resetting the phone. Activation Lock needs separate attention only when the device is affected by it. Whether to erase the phone should be decided after you have backed up what you can and confirmed the situation you are actually dealing with.

My previous article dealt with the difficult combination of losing control of two-factor authentication and having the device affected by Activation Lock tied to the original account. That was my personal experience; not every stolen Apple ID case follows exactly the same path.

Q2. What does the approval email for a reset request mean?

What I called “asking Apple to approve a reset” in the earlier article is closer, in Apple’s current terminology, to submitting an Activation Lock support request. If a device is protected by Activation Lock and you cannot remove it with the original Apple Account or device passcode, Apple currently requires proof-of-purchase documentation before you can submit that request.

Activation Lock links a device to the Apple Account used to set it up. Even after the device is erased, it may still require the original account information before it can be activated again. If the support request is approved, it addresses Activation Lock on that device so the device can be set up again.

That does not mean you have recovered the stolen Apple Account, and it does not restore control of the iCloud data, purchases, or other services in the original account. Recovering the account still requires a separate password-reset or account-recovery process.

Q3. Do I have to reset the device immediately after the approval email arrives?

In my case, I backed up the data I needed from the phone before resetting it. However, how long you have to act after approval depends on the email you actually receive and Apple’s instructions at that time. Apple’s public guidance does not offer a universal guarantee that there is no time limit, so do not postpone the process indefinitely based only on my experience.

Submitting an Activation Lock support request does not immediately erase the data on the phone. The local data is deleted only when you actually erase or reset the device. Before performing anything that wipes the device, complete every feasible backup and make sure you understand the steps in the approval email.

Q4. What happens after the reset?

After the device is erased or reset, its local data is gone. If Activation Lock has also been removed according to the approved request, you can set up the device again and sign in with an Apple Account you control.

This does not necessarily mean the original Apple Account must be abandoned forever. If you can regain control through a password reset or account recovery, you may be able to keep using it. The loss of access to the original account’s data and purchases becomes an issue when the account truly cannot be recovered and you switch to a new one.

App purchases and download history remain tied to the original Apple Account and do not automatically transfer to a new one. After switching accounts, downloading or updating some apps may still require the original credentials. If you cannot authenticate the old account, you may need to obtain or purchase some items again.

Likewise, data stored in iCloud still belongs to the original account. If you cannot sign back in, you cannot directly retrieve that cloud data. That is why you should back up any important information you can still access before erasing the device.

Another reader asked whether mobile-game accounts, memberships, and similar services would be affected.

It depends on how the account or membership is linked. If the service uses Sign in with Apple and you can no longer access the original Apple Account, signing in or recovering data may be affected. If you created an independent account or still have another usable sign-in method, what happens depends on that service’s account system.

If you do not erase the device immediately, apps already installed may remain on the phone. But whenever a download, update, or purchase verification requires the original Apple Account and you cannot sign in, you may be unable to complete the action. The result varies by app, purchasing account, and the system requirements in effect at the time.

Q5. What if I bought the phone from a mobile carrier or retailer and need proof of purchase?

Let me say this up front: I do not know. I bought both my iPhone and iPad directly from an Apple Store as unlocked devices, not with a mobile plan.

I have not handled this situation myself, so I cannot promise anything, but I can suggest a possible approach.

If you bought the device from a carrier or retailer, they may still have the original sales or purchase record, so it is worth asking whether they can provide documentation.

What Can Happen After Your Apple ID Is Stolen?

This is probably the question I received most often by direct message or email.

First, what happened to me is likely only one of many possible outcomes. It does not mean a stolen Apple ID and the information inside it can only be used in the way described below.

Private personal data can also be misused, so please be careful.

Canceling Your Cards and Suspending Carrier Billing Can Prevent Unauthorized Charges

Your original Apple ID may have been linked to Apple Pay, and your phone may also have contained information related to online banking or credit cards.

Canceling the cards and asking the banks to reissue them gives you new card numbers and security codes, which helps prevent already-exposed old card details from being used for new transactions. It is still a good idea to keep monitoring your statements afterward.

Fortunately, none of the banks behind the cards I held charged me an extra fee for canceling and reissuing them.

I also use several online banks, including Richart and KOKO. After resetting the phone, I changed every one of those account passwords.

Six months later, I had not encountered any unauthorized charges on my own credit cards or unexplained activity in my bank accounts.

After resetting the phone, I linked carrier billing to the new Apple ID. It had also been safe for six months, with no strange charges or app-download fees on my monthly bills.

One important point: do not postpone every account and payment-security step until after resetting the phone. If you still have access, change or reset the Apple Account password as soon as possible, review the security information, and remove unfamiliar devices. If your cards, bank accounts, or carrier billing may be at risk, contact the bank or carrier immediately.

What should wait until the backup is complete is the device erase or reset that will wipe local data. In other words, first take the steps that can immediately reduce account and payment risk; then handle the device after confirming the backup and Apple’s instructions. Do not treat these as the same task.

Your Apple ID May Be Used as a Mule Account for Criminal Activity

This has been the most persistently frustrating part for me. I suspect it may be one major reason someone would steal an Apple ID, but I have to admit that I have no way to stop it.

About a month after my Apple ID was stolen, I registered a new Apple ID with another email address. Meanwhile, the email address originally used for the stolen account began receiving a series of messages.

The first was a notification that the billing information on the stolen Apple ID had been changed.

That first email was old enough that I could no longer find it, so I used a similar recent message to show readers what it looked like.

As you can see, the problem was still bothering me six months later.

My first thought was, “Oh, great—another phishing email?”

Then I remembered: right, this was already the stolen account. It had nothing to do with my new Apple ID.

I do not know whether someone was testing to see if I would react, but a few days after the billing information changed, my inbox suddenly filled with many notifications in a very short time.

They were all Apple Store receipt emails. Since they concerned the old Apple ID that had been stolen, the purchases obviously were not mine.

Curiosity got the better of me, so I opened one to see what my old account was being used for.

The card number startled me. I initially thought one of my old cards had been used for all those unauthorized charges.

But when I compared the number with every card I had held, none ended in those four digits.

In other words, the card information had come from somewhere else.

At that moment, I thought I understood why someone would use a phishing site to obtain an Apple ID.

It might not be about using the apps you purchased, and it might not even be primarily about the personal information in your Apple ID.

Based on how the stolen account was used in my case, my inference is that it may have been linked to card information taken elsewhere and then used for repeated in-app purchases. I cannot confirm the actual method or motive.

I have personally been through credit-card fraud too = =. You can read that story here: My Credit Card Was Actually Stolen?!

The app used for the purchases can vary. I had previously seen a football game; the example above was baccarat.

The money may have been extracted through the mobile game’s operator rather than through Apple’s official refund system.

The cardholder behind the receipt shown above was charged NT$3,290 over and over—and on more than one day, Orz.

You may be wondering whether there was any way to prevent all of this.

After I lost control of two-factor authentication, customer support told me that the Apple ID was no longer considered mine. I had no way to stop what followed.

The unauthorized-purchase activity continued from time to time. It was endlessly frustrating, and I still could not make it stop.

Eventually, out of sheer frustration, I set up Taiwan’s Ministry of Finance e-Invoice app and imported every receipt that had been issued in my name because of those purchases—just so I could enter the receipt lottery.

Naturally, not a single one ever won.

Otherwise, why would I still be here writing articles and waiting for donations? Orz.

Conclusion

This article briefly answered some of the questions I had previously received by message or email.

The other focus was what happened to me after my Apple ID was stolen.

Many people worry that their personal information may leak. In my case, I used the phone only as a work device; apart from food photos, nearly everything on it was work-related.

That meant I personally had less of this particular concern.

Based on how my stolen account was used afterward, my own inference is that the thief’s target is not necessarily your personal photos or videos.

Still, a phone is a deeply personal object, and there are plenty of bad actors. Be cautious, verify suspicious messages more than once, and avoid keeping too many private photos or videos online or in the cloud.

I also recommend enabling LINE alerts, text alerts, or online-banking controls for your accounts so you can catch suspicious charges immediately. One moment of inattention can cost hundreds of thousands of dollars, Orz.

Even when a charge can be disputed and refunded, staying alert is still the better approach.

I hope this article fills in what the previous one missed and answers some of the questions readers had.

Official Sources

The account-recovery, Activation Lock, and device-handling guidance in this article has been supplemented using the official Apple sources below. For any real case, follow the screens, approval email, and current instructions Apple provides to you.

• If you think your Apple Account has been compromised
• How to use account recovery when you can’t reset your Apple Account password
• How to remove Activation Lock
• Activation Lock for iPhone and iPad