The Hassle of Having My Apple ID Stolen

Introduction

A credit card of mine had been used fraudulently once before. I had linked it to PayPal and later had to deal with problems involving the account and payment details. That is my experience, not evidence that PayPal accounts in general are especially easy to steal.

Just as I described in My Credit Card Was Actually Stolen?!, the thief went wild with my card.

In a single minute, there were at least ten charges of NT$1,234. It was a nightmare, and I had to ask the card issuer for a replacement.

So what does it mean to have your Apple Account stolen? Let me begin with the conclusion of how I handled it.

If the account password is exposed but you still have a trusted device or your original two-factor authentication method, change or reset the password promptly and review the account information and signed-in devices. Changing my password was also my first thought.

If your two-factor authentication details have also been stolen—well, that is much harder. In my case, I eventually had to provide proof of purchase, ask Apple to remove Activation Lock, and reset the devices. Try the trusted-device, password-reset and account-recovery options first; losing control of two-factor authentication does not automatically mean the account and its data are beyond recovery.

2026 update: The paragraph above records what happened to me in 2022 and the path I ultimately took. Under Apple’s current guidance, if your password or two-factor authentication details have been changed, first try changing or resetting the password on a trusted device and review any account information or devices you do not recognize. If you still cannot sign in, start account recovery at iforgot.apple.com. Recovery can take several days or longer, so losing control of two-factor authentication does not always mean the account is permanently unrecoverable. If the account cannot be recovered and the device remains restricted by Activation Lock, follow Apple’s instructions to submit an Activation Lock support request with proof of purchase. See Apple’s guidance on a compromised Apple Account, account recovery, and removing Activation Lock.

My case fell into the latter category. While I was fighting to regain control, I found almost no firsthand accounts from people whose two-factor authentication information had also been taken.

Even when I found relevant information, some of the proposed solutions looked like dangerous phishing sites themselves—an easy way to get scammed twice. I therefore decided to document the entire process for anyone who might need it.

What Happened and How I Handled It

So how did it happen?

One night before the second stage of the national examination, I was about to go to sleep and started scrolling on my phone. This email was sitting in my inbox.

I panicked when I saw it. I had bought paid apps such as Procreate and Goodnotes through the account, and losing them would have been awful.

I opened the link in the email and went through a series of password-change and verification steps.

About twenty seconds later, the Apple Account on my iPhone was forcibly signed out, and a string of messages arrived in my email.

“Damn, my account has definitely been stolen.” That was my immediate reaction.

Sure enough, when I looked back at the email and checked the sender, the address was not an official Apple address at all. It was a phishing site pretending, from beginning to end, to be Apple.

I realized what had happened within about two minutes and knew the fight had begun. I searched for what to do when an Apple Account is stolen, and most of the advice said, “Just change the password through iCloud.”

I went to iCloud ready to change the password, only to see the screen below.

Normally, if an attacker has only obtained the account password, two-factor authentication—such as an SMS verification code—can help you take back control and change the password.

But as I replayed the phishing flow in my head, I realized it had taken me through several steps that also changed the information used for two-factor authentication.

The result was that the trusted phone number had been replaced with a number I had never seen.

Even when I selected “Forgot Apple Account or password,” I could no longer use two-factor authentication to reclaim the account.

“Why not just create a new account?” you might ask.

That was my first thought too—until I saw the following email and realized the problem was much bigger.

I suddenly remembered that several credit cards were linked to Apple Pay on my phone, which also contained mobile-banking apps from several banks.

For convenient App Store purchases, I had also linked carrier billing from Far EasTone to the account.

“Are they binding my cards one by one so they can start making fraudulent charges?” I wondered.

From what I understood about Apple Pay, obtaining an Apple Account alone should not make it easy to charge my cards. Still, I had no idea what techniques the other side was using.

Almost immediately after taking my password and verification details, they changed all of the account information. It looked automated rather than manual.

Speaking as another front-end engineer: if this is what you use your programming skills for, you are truly awful. I mean it.

At the same time, it looked possible that information tied to my cards and carrier billing was at risk. That made this a serious emergency.

In the middle of the night, I called each card issuer to ask whether there had been any unauthorized transactions between 12:30 a.m. and the time of my call, and to request that every card be blocked and replaced.

It was a nightmare. I had cards from Taishin, Cathay United, Hua Nan, SinoPac, and CTBC. I spent about an hour explaining what had happened, reviewing transaction records, and locking the cards.

I also called Far EasTone to check whether any carrier-billed purchases had occurred since the account theft and to disable all carrier billing.

The representative kindly disabled Google Play carrier billing as well, so the attacker could not abandon the App Store, bind the number to Google Play, and go on a shopping or top-up spree.

Why did I think the person who stole my Apple Account might have reached something connected to my cards?

When I called Taishin’s credit-card support line, the representative told me that, five minutes after the account was stolen, my card had been added to another device and a NT$0 authorization had appeared, although no purchase had yet been made.

2026 update: This records what the bank representative told me about my individual case. It does not mean that obtaining an Apple Account automatically reveals a full card number or completes a payment. Apple’s current security documentation says that Apple Pay does not store full card numbers on the device or Apple Pay servers; adding a card to another device still requires verification and approval by the issuer or payment network, and payments require user authentication. Even so, if you see an unfamiliar card setup, authorization, or transaction notice, the safest response is to contact the issuer immediately and ask it to review the activity and disable the relevant card or Apple Pay access. See Apple’s documentation on card provisioning security and payments with Apple Pay.

That was when I understood how much could be disrupted when someone else took control of my Apple Account.

If I had left it alone, I imagined waking up to a stream of card transactions and carrier-billed purchases.

Dealing with fraudulent charges on a single CTBC card had already been troublesome enough. This time I might have had to explain an unknown number of charges across several cards while also handling carrier billing.

I have to say it again: people who run phishing sites like this are absolute garbage.

Once every card was blocked and reissued and carrier billing was disabled, I could at least be confident that the money in my accounts was safe for the moment.

The next problem was that my iPhone and iPad were still tied to the original Apple Account, which I could no longer access, and warning dialogs kept appearing.

I tried to unlink the iPhone and iPad through the system settings. Unfortunately, because the attacker had changed my password, I could not remove the account from either device.

All I could do was watch the password prompt appear again and again.

The devices still worked, but without access to the Apple Account I might not have been able to update apps, and I could no longer use Apple Pay.

I searched for a way to remove the Apple Account directly. I found third-party tools such as iMyFone LockWiper, but after going through their flows you discover that they charge a considerable amount.

I do not know whether those tools work. In the end, I chose Apple’s official process instead of third-party software.

How could I begin that official process? After thinking it over, the best option seemed to be calling support directly.

I found two numbers online—0800-020-021 and 0800-095-988—but it was nighttime in Taiwan, and no one answered.

Apple support was not available twenty-four hours a day through those lines.

Some people online said those numbers would transfer you back and forth. In my earlier experience calling to ask whether the Xinyi flagship store had iPhones in stock, however, I got an answer quickly and did not run into that problem.

Still, here is the method I used to have Apple support call me quickly, in case anyone needs it.

First, go to Apple’s official website. There is a Support link in the upper-right corner; selecting it takes you to the screen below.

Although my problem concerned an Apple Account, I chose Music because, at the time, it seemed to be a faster route to the support contact options.

On the next page, scroll to the section for more topics, then choose the option to get support and start the process.

The site asks what kind of problem you have. I selected “Billing Issues,” pressed Continue, and reached the following screen.

Because the situation felt urgent, I chose the voice-support online chat option. That route had a representative call me directly instead of making me call, wait, and be transferred.

Most problems could also be handled through that representative.

After submitting the form, I received a call very quickly. Outside business hours, you could still complete the form and choose a time for support to call.

My account was stolen at night, so I eventually went to sleep.

The next morning, support called at the scheduled time. After I explained that both my password and two-factor authentication information had been changed, the representative said, “Then the Activation Lock has to be removed.”

Because of Apple’s security design, a device tied to an Apple Account can remain associated with that account even after a factory reset. In my case, with both the password and verification information changed, I could not switch accounts through the normal methods available to me.

The representative said I needed to submit an Activation Lock support request. Once Apple removed the lock, I could restore the device and use it as a fresh device.

The tradeoff was losing apps purchased through the old account, and the existing data on the phone would also be erased.

I was therefore advised to create a backup before restoring the device.

One important detail in my situation was to back up directly to a computer rather than iCloud. Because I had lost the account, I would not be able to retrieve an iCloud backup through it afterward.

The changed account information also meant I could not sign in to iCloud at all, so any backup I could make had to begin with data still present on the phone.

Fortunately, I had backed up the phone for work not long before. There was very little left to save, so I could proceed.

To submit the request to Apple, I needed proof that I owned the devices in my hands.

You may be asking, “What counts as proof of ownership?”

It meant the original proof of purchase—in other words, the receipt—and it had to show the device’s serial number. This helped establish that I owned the device rather than having found it, kept it, or tried to inspect someone else’s information.

“Who keeps a receipt that long? What if it is gone?” you may ask next.

Exactly. That was my situation: the receipts for both my iPhone and iPad were gone.

Support told me to return to the places where I had bought the devices and request proof of purchase. A photo or screenshot of that document could stand in for the original receipt.

By coincidence, I had bought the iPhone from a reseller and the iPad from an Apple Store, so I went through both versions of the process. Here is how each one worked for me.

What if you have forgotten where you bought the device? At the time, I understood that I would have had to keep using the iPhone or iPad without being able to sign in to that Apple Account.

The purchase record was held by the original seller; another reseller would not necessarily be able to find it.

I had bought my iPhone at Studio A in Miramar, so I went there first to request proof of purchase.

I was not sure the record would still exist because I had bought the phone about three years earlier. After verifying my basic information, however, the employee found the archived purchase record.

The employee photographed the iPhone, entered its serial number, and used the store’s internal system to submit the request for proof of purchase.

I still had to hurry to the next stop, so I asked the employee to email the proof of purchase to me.

I expected the request to take forever. Instead, by the time I had left Miramar and ridden the MRT to Wende Station, the proof-of-purchase email had arrived.

The speed made me marvel at how quickly Apple’s internal process could move. Seriously—so efficient!

The iPad had come from the Apple Store in Xinyi. Because the store was operated by Apple, I explained the situation to a service employee, verified my information, and received the proof of purchase quickly there too.

Broadly speaking, buying through Studio A or a carrier meant going through an extra request process. It was more troublesome, although it did not take very long in my case.

When the device had been purchased directly from Apple, I could skip that extra request step and obtain the proof more directly.

With both proofs of purchase in hand, I could move on to the Activation Lock removal process.

How to remove Activation Lock

The support representative sent me the link above at the time.

Activation Lock means, in practical terms, that a device can remain tied to the original Apple Account even after a factory reset.

Because my password had been changed and I could not complete two-factor authentication, I selected the circled option to start an Activation Lock support request.

On the page shown above, I went to the additional-support area, selected the option to begin, completed the form, and submitted the request.

A confirmation email then arrived, and all I could do was wait for good news.

At the time, I was told that one email address could submit only one request, so I was advised to use two email addresses for two devices rather than wait for the first case to finish.

I was also told to avoid connecting the devices in the requests to a computer or updating iOS or apps during the wait, because doing so might extend the review.

2026 update: The statements above about one request per email address and avoiding computer connections or updates were operational instructions I received while handling Activation Lock support requests in 2022. Apple’s current public account-recovery guidance does warn against using other Apple devices already signed in to the same account after recovery begins, because doing so can interrupt or cancel recovery. However, account recovery and an Activation Lock support request are different procedures. If you apply now, follow the conditions shown by Apple, the confirmation email, and current support instructions rather than treating my 2022 restrictions as permanent rules.

The wait was not very long in my case. I discovered the theft early on October 12, spent that morning and afternoon running around for proof of purchase, and submitted the request around the time I went to work that evening.

The approval email arrived on the evening of October 14. Support had told me it could take ten days, so I had prepared for the full wait. Finishing within two days felt astonishingly fast.

Apple handled the actual removal of Activation Lock. After the email arrived, all I had to do was restore the device. The old account association was gone, and I could begin a new life with a new Apple Account.

Of course, I still had to rebuild the data and repurchase the apps. There was no way around that in my case.

Conclusion

Back to the original point: if only the password has been exposed and you still control a trusted device or the original verification method, reset or change the password quickly and check your account details and devices.

If someone also tricks you out of your two-factor authentication details, first try Apple’s current account-recovery options. I could not recover my account in 2022, so I eventually requested Activation Lock removal and reset the devices; in my case, I also had to rebuild my data.

The process I followed can be reduced to a few broad steps:

Block and replace the cards and disable carrier billing → find proof of purchase (or request it from the original seller) → request Activation Lock removal and wait for review → back up the data → restore the devices to factory settings.

In my case, the waiting periods were short—no more than two or three days—and more time went into traveling to different locations for proof of purchase.

2026 update: I did receive approval to remove Activation Lock after about two days, but that was one individual case, not a processing-time guarantee from Apple. Apple’s current account-recovery guidance says recovery can take several days or longer and that support cannot shorten the waiting period. Apple also does not publish a fixed turnaround time for Activation Lock support requests. If you are handling a similar problem now, rely on the notices and case status Apple sends you.

The Activation Lock support form itself was not especially difficult. I had recently been applying to multinational companies, and those application forms were far more troublesome than this one.

The process felt frightening mainly because so little information was available. Looking back, the steps were not particularly difficult. Keeping the original receipts would have saved a great deal of trouble.

I also have to say that Apple’s layers of data protection are extensive. If you have set a screen passcode, someone who finds your phone will have a very hard time reaching its contents without that code.

A person who finds a phone or iPad also cannot easily determine where it was purchased. Without knowing the seller, obtaining proof of purchase is difficult.

There are many layers of protection.

For the first time, I felt how hard it was to prove the device in my hands really belonged to me. My legal brain even wandered to the question of who has to prove a right to possess something in a Civil Code Article 767 dispute—though an Apple support request is, of course, a different process. Orz.

I went through all of this, so I hope the record helps someone who needs it.

I collected what happened after my Apple Account was stolen—and my answers to readers’ questions—in this follow-up: What Happened After My Apple ID Was Stolen—and Answers to Common Questions.