1

Before you downvote this question consider that I'm not the first to run into Apple's odd recursive authentication loop.

Frustrated Apple User sums it up as:

So Apple could do nothing and this guy is allowed to use my email as his apple ID as long as he wants and I will receive emails from Apple when he uses his device, etc.

It's an established problem with Apple authorization and authentication. (My account is gmail, but it's basically the same underlying problem.)

While probably not a phishing attack, it certainly could be malicious.


Apple wrote:

Thanks for contacting us. I'm sorry that you weren't able to reset your Apple ID password. I’ll do everything that I can to get your issue resolved. If you haven’t already, you can try resetting your password online at: http://iforgot.apple.com For more information on resetting your security questions, see this page: https://support.apple.com/HT201485 For security reasons, I can't help you access this account via email.

So far as I know my account has been hijacked. I say my account, because it's my e-mail address which is used to login. So far as I know this is some variant of a malicious social engineering attack.

How do I contact Apple by chat?

When I try to contact Apple through Chat I get:

secret question

and so cannot proceed with resetting the password.

Notably, signing up for a mailing list has better authentication and authorization.

Or, an e-mail address for Apple would be a good way to enter into a dialogue with them. Do they have an e-mail address? Their e-mail to me came from appstore_emea@apple.com but they've already explained that they won't reset the password via e-mail.

When I try to contact Apple support through their website it goes in a loop where they want my Apple ID and then challenge me with secret questions.

At best it's annoying. At worst it's some sort of attack. This has been going on at least since 2016, we're almost in 2019.

This is the e-mail, or a portion of:

Welcome to iCloud.
Your Apple ID is <me>@gmail.com.
iCloud keeps all your photos and videos, documents, contacts, and more up to date automatically, so you always have access to the latest versions on all your devices. 
  • 1
    Why not confirm the phone number? – Solar Mike Dec 27 '18 at 10:55
  • 2
    If I understand you correctly, somebody else used a string matching your Gmail address as their AppleID identifier, right? And you tried to contact Apple based on the AppleID with your Gmail adress? – nohillside Dec 27 '18 at 12:04
  • 2
    @Thufir why can't you provide the phone number you used with your Apple ID? - Did you change it? - Do you think the criminal who stole your account changed it? – daniel Azuelos Dec 27 '18 at 12:20
  • 2
    Did you personally create an AppleID with this gmail address? Or did you just receive the email out of the blue? – nohillside Dec 27 '18 at 13:19
  • 2
    So anybody walking up to your unlocked computer, or hacking your Gmail account, could easily change the password for your AppleID? I‘m quite happy to know that this is not possible without additional steps. – nohillside Dec 27 '18 at 13:58
2

How to contact Apple if somebody has created an AppleID using an email address of mine.

This particular answer is meant to address the qualifier (emphasized) portion of the question.

Unless your email address is not 100% solely in your control, this cannot happen.

Why? Because immediately upon creating an AppleID, you are immediately asked to confirm the account and an email is with with a code only; there are no links to click or addresses to reply to.

To be perfectly clear, an AppleID cannot be created unless someone physically types out the confirmation code in the boxes on Apple's AppleID website.

What this means

If "someone", whether nefarious or innocent intentions, created an AppleID account with your email address they either had:

  • access your email account
  • access to a trusted device that's no longer in your possession (sold, gifted, or stolen)
  • you confirmed the account and forgot about it.

What is Apple going to do?

Nothing, unless you can authenticate with the credentials the account creator provided.

  • email address
  • Birthday
  • Phone Number (required in some countries)
  • 3 different security questions with 6 options each as to the question being asked (18 different permutations)

Apple needs to validate who you are before it will even contemplate making a change. The reason for the extra verification credentials is for the simple reason email addresses and phone numbers change; your birthday and the city where your parents met (one of the questions) will not.

So far as I know my account has been hijacked. I say my account, because it's my e-mail address which is used to login. So far as I know this is some variant of a malicious social engineering attack.

It could be your account and equally as likely it's not. We (here on Ask Different) and Apple only have your word that the email is in fact "yours." How do we know that you haven't compromised the legitimate AppleID account owner and you're attempting to hack their credentials? How secure would AppleID be if they allowed anyone to merely claim an email address was theirs and to reset the password?

(It's not an accusation, it's an academic exercise)

I can already hear your argument: It's my email account. Ok, let's look at it from Apple's prospective:

  • Given the security process, your email must have been compromised when it was created
  • Given that you can't authenticate any other security credential, but claiming you've got access to email means email is potentially compromised now.

From Apple's perspective, it's not their problem.

  • 1
    Nice answer, thanks Allan. I wonder whether the "verify with code" part also happens if one creates a new AppleID during the setup of a new Mac or a new iDevice? – nohillside Dec 27 '18 at 18:00
  • 1
    @nohillside - I don't have a new Apple device to test on (Santa/St. Nick/Kris Kringle/Father Christmas, et. al was good, just not that good), but I don't think it would matter. The email address would have to be validated meaning either account was compromised or the user validated and forgot. – Allan Dec 27 '18 at 18:04
  • This is why I was concerned: the e-mail account must've been compromised by your answer. Are you absolutely positive of that? Because by your answer there's a bad actor involved somewhere. (I take your rhetorical point that maybe that's "me" -- but it's not. Trust me.) I'm going to re-enable MFA on my gmail and change the password, but that doesn't give me access to "my" or "the" Apple ID for my e-mail account. Leaving open just for a bit. Thx. – Thufir Dec 27 '18 at 18:25
  • 1
    @Thufir was your Gmail password stolen? You can check this through 2 ways: • you received an E-mail from Apple to check your E-mail address and this confirmation wasn’t expected (i.e. a criminal using your Gmail account answered in place of you), • on this web server: haveibeenpwned.com . – daniel Azuelos Dec 27 '18 at 18:28
  • I will add that, for my spam-trap gmail account, I believe I created an account some time ago for an Apple ID. That Apple ID was definitely compromised, because my "name" is not what I would use, but I was able to regain control via e-mail. I don't believe it's required to authenticate with a code to setup an Apple ID. But, I don't know that for a fact. Hopefully Apple will respond to my second e-mail to them. (I don't really mind that much that my spam-trap account was compromised, insofar as the Apple ID. Neither here nor there.) – Thufir Dec 27 '18 at 18:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.