Yesterday, I got a bunch of emails from Apple, sent to one of my unused gmail addresses (which still has forwarding to my regular one). I do NOT have an appled ID associated with that address, but it seems like someone was trying to create one.
They were (all in English unless otherwise noted):
- 10-12 identical "Verify your Apple ID." emails from firstname.lastname@example.org, some in English, some in Greek (I'm Greek and in Greece, so this makes some sense).
- "Your apple ID has been used to sign in to iCloud from an iPhone 4s." email from email@example.com (not sure about wording, because this one was sent in Greek: Το Apple ID σας χρησιμοποιήθηκε για σύνδεση στο iCloud από iPhone 4s.)
- "Your apple ID information has been updated" from firstname.lastname@example.org
- "Welcome to iCloud" from email@example.com
I was alarmed by this. I'm 99% certain I did NOT ever create this apple ID, and 100% certain I didn't use it yesterday, from an iPhone or elsewhere. I went to the apple site, clicked on "reset my password", got a password reset email right away, and changed the password.
I checked ALL my gmail accounts (the one used for the ID, the regular one & a secondary one I have) and there has been no sign of breaching - no connected devices or recent sign-ins I don't recognize, no auto-forwarding or suspicious labels created.
Today, I received another email from apple
- "Your recent download with your Apple ID." from firstname.lastname@example.org
I therefore realize that the device has somehow not been disconnected, although I believed that, as with other services eg. Google, whenever you change your password, each device asks you for the new password when automatically signing in. Is this not the case with Apple?
To rephrase, does Apple automatically sign out all connected devices when changing your password?
I also had to install iTunes, so that I could deauthorize the devices already connected, but the option does not show up on the list, which seems to mean there are no devices associated. The only method I found for doing that without using iTunes did not work properly.
The details which the person has entered to the account associated with my email seem legitimate (as in, non-spam/scammy) but it looks like they're not tech-savvy enough to even realize they're using the wrong email, so I don't think contacting them (they've even listed their phone number) would have any benefit.
Is it really possible for someone to register for an Apple ID and continue using that ID without verifying the email? Because this is what seems to be happening. I never clicked on those "verify" links, they even look unread in my inbox, but it seems like this person is still using that ID.
My goals here are
- To make sure my email account is safe
- To stop receiving annoying emails every time this person does anything related to their apple id.
- To ideally stop this person from signing up for apple IDs or other accounts using an email that doesn't belong to them (and can possibly be a typo, judging by their name).
Any help/feedback at all will be greatly appreciated.