1

Before you downvote this question consider that I'm not the first to run into Apple's odd recursive authentication loop.

Frustrated Apple User sums it up as:

So Apple could do nothing and this guy is allowed to use my email as his apple ID as long as he wants and I will receive emails from Apple when he uses his device, etc.

It's an established problem with Apple authorization and authentication. (My account is gmail, but it's basically the same underlying problem.)

While probably not a phishing attack, it certainly could be malicious.


Apple wrote:

Thanks for contacting us. I'm sorry that you weren't able to reset your Apple ID password. I’ll do everything that I can to get your issue resolved. If you haven’t already, you can try resetting your password online at: http://iforgot.apple.com For more information on resetting your security questions, see this page: https://support.apple.com/HT201485 For security reasons, I can't help you access this account via email.

So far as I know my account has been hijacked. I say my account, because it's my e-mail address which is used to login. So far as I know this is some variant of a malicious social engineering attack.

How do I contact Apple by chat?

When I try to contact Apple through Chat I get:

secret question

and so cannot proceed with resetting the password.

Notably, signing up for a mailing list has better authentication and authorization.

Or, an e-mail address for Apple would be a good way to enter into a dialogue with them. Do they have an e-mail address? Their e-mail to me came from [email protected] but they've already explained that they won't reset the password via e-mail.

When I try to contact Apple support through their website it goes in a loop where they want my Apple ID and then challenge me with secret questions.

At best it's annoying. At worst it's some sort of attack. This has been going on at least since 2016, we're almost in 2019.

This is the e-mail, or a portion of:

Welcome to iCloud.
Your Apple ID is <me>@gmail.com.
iCloud keeps all your photos and videos, documents, contacts, and more up to date automatically, so you always have access to the latest versions on all your devices. 
24
  • 2
    If I understand you correctly, somebody else used a string matching your Gmail address as their AppleID identifier, right? And you tried to contact Apple based on the AppleID with your Gmail adress?
    – nohillside
    Commented Dec 27, 2018 at 12:04
  • 2
    @Thufir why can't you provide the phone number you used with your Apple ID? - Did you change it? - Do you think the criminal who stole your account changed it?
    – dan
    Commented Dec 27, 2018 at 12:20
  • 2
    Or, in other words, can you describe the part of your problem which can not be answered by referring you to apple.com/contact (or the equivalent for your country)?
    – nohillside
    Commented Dec 27, 2018 at 12:21
  • 2
    Did you personally create an AppleID with this gmail address? Or did you just receive the email out of the blue?
    – nohillside
    Commented Dec 27, 2018 at 13:19
  • 2
    So anybody walking up to your unlocked computer, or hacking your Gmail account, could easily change the password for your AppleID? I‘m quite happy to know that this is not possible without additional steps.
    – nohillside
    Commented Dec 27, 2018 at 13:58

3 Answers 3

3

Same issue here, Allan's answer is unhelpful and presumptuous that it is "impossible" for an email address to be tied up to an Apple ID without being verified.

Although it has not been verified, the email address is still unavailable for anyone else (like the actual owner of the address) to use.

2
  • thanks for chiming and confirming what should, frankly, be obvious and non-controversial. Answer accepted.
    – Thufir
    Commented Apr 16, 2020 at 17:09
  • 2
    I don't really understand how Allan thinks that because it was user error by his clients, it must be user error by everyone else. He is talking about confirmation bias, but his clients are simply reinforcing his own bias! My email address is tied up with someone else's Apple account - my email is NOT hacked (it is a Google account so I can see exactly where it's been accessed), the verification link has NOT been clicked by me or anyone else, but it still tied up in that Apple account. IT rule no 1: there is no "this cannot happen" rule.
    – kh42874
    Commented Apr 17, 2020 at 9:01
3

How to contact Apple if somebody has created an AppleID using an email address of mine.

This particular answer is meant to address the qualifier (emphasized) portion of the question.

Unless your email address is not 100% solely in your control, this cannot happen.

Why? Because immediately upon creating an AppleID, you are immediately asked to confirm the account and an email is with with a code only; there are no links to click or addresses to reply to.

To be perfectly clear, an AppleID cannot be created unless someone physically types out the confirmation code in the boxes on Apple's AppleID website.

What this means

If "someone", whether nefarious or innocent intentions, created an AppleID account with your email address they either had:

  • access your email account
  • access to a trusted device that's no longer in your possession (sold, gifted, or stolen)
  • you confirmed the account and forgot about it.

What is Apple going to do?

Nothing, unless you can authenticate with the credentials the account creator provided.

  • email address
  • Birthday
  • Phone Number (required in some countries)
  • 3 different security questions with 6 options each as to the question being asked (18 different permutations)

Apple needs to validate who you are before it will even contemplate making a change. The reason for the extra verification credentials is for the simple reason email addresses and phone numbers change; your birthday and the city where your parents met (one of the questions) will not.

So far as I know my account has been hijacked. I say my account, because it's my e-mail address which is used to login. So far as I know this is some variant of a malicious social engineering attack.

It could be your account and equally as likely it's not. We (here on Ask Different) and Apple only have your word that the email is in fact "yours." How do we know that you haven't compromised the legitimate AppleID account owner and you're attempting to hack their credentials? How secure would AppleID be if they allowed anyone to merely claim an email address was theirs and to reset the password?

(It's not an accusation, it's an academic exercise)

I can already hear your argument: It's my email account. Ok, let's look at it from Apple's prospective:

  • Given the security process, your email must have been compromised when it was created
  • Given that you can't authenticate any other security credential, but claiming you've got access to email means email is potentially compromised now.

From Apple's perspective, it's not their problem.

17
  • 1
    Nice answer, thanks Allan. I wonder whether the "verify with code" part also happens if one creates a new AppleID during the setup of a new Mac or a new iDevice?
    – nohillside
    Commented Dec 27, 2018 at 18:00
  • 1
    @nohillside - I don't have a new Apple device to test on (Santa/St. Nick/Kris Kringle/Father Christmas, et. al was good, just not that good), but I don't think it would matter. The email address would have to be validated meaning either account was compromised or the user validated and forgot.
    – Allan
    Commented Dec 27, 2018 at 18:04
  • 1
    @Thufir was your Gmail password stolen? You can check this through 2 ways: • you received an E-mail from Apple to check your E-mail address and this confirmation wasn’t expected (i.e. a criminal using your Gmail account answered in place of you), • on this web server: haveibeenpwned.com .
    – dan
    Commented Dec 27, 2018 at 18:28
  • 1
    I don't believe this answer is correct simply based on the fact that others report the same problem. That is, that their e-mail account is used to create an Apple ID without ever requiring a confirmation e-mail. Let's turn this around: let's say that I buy an iPhone. Can I not now use my e-mail to register an iCloud account? After all, it's my e-mail. Which Apple has now associated with secret questions, like a phone number, entered by another.
    – Thufir
    Commented Jul 30, 2019 at 6:30
  • 1
    Let's do this, @Allan : I'll forward you the actual e-mail from Apple where they acknowledge that it's entirely possible for another person to register my e-mail account without access to my actual e-mail.
    – Thufir
    Commented Aug 4, 2019 at 7:57
2

I have this situation with a domain we purchased from another person who happened to set up an AppleID account with it before we purchased the domain-—so we now have the same email address but we can't reset the appleID with it alone--but we do get all AppleID related email intended for the previous owner.

I'm not sure how to deal with that problem——but it is an example of this happening without losing control of an email address. Instead, we purchased a domain that expired and had email addresses on it we are re-using, so to speak, that have AppleIDs tied to them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .