Is my Apple Id under attack, and how do I fix it?

Question

So I got an e-mail from Apple which says:

You recently requested a password reset for your Apple ID. To complete the process, click the link below. Reset now > If you didn’t make this change or if you believe an unauthorized person has accessed your account, go to iforgot.apple.com to reset your password immediately. Then sign into your Apple ID account page at https://appleid.apple.com to review and update your security settings. Apple Support

I didn't request any such password, and I already know my password, but when I try to log into my account to check my security settings it wants me to answer two security questions, neither of which I recognize. So I go to try to change my security questions at the "iforgot" domain, and it says:

Choose a method to reset your security questions.

• Use credit card information Enter the details for the card on file with Apple. Your card will not be charged.
• Answer your current security questions Answer the question(s) you chose when you created your Apple ID.

The problem is, I obviously can't use the second method because since I don't recognize the questions, I can't know the answers. But I also don't know what credit card Apple is asking for here. I may have used more than one card with Apple in stores, but I don't recall if I have ever used one online, and in fact I may have used a "throw-away" number.

So I'm not sure what to do here. Is my account under attack? How can I get control of my account back?

Answer 1

I would absolutely follow the “if you did not request this” instructions to the letter. Since you may have difficulty with security questions or past purchases, I would open a support case with Apple and take good notes what you trying anything seems odd.

Just be sure you don’t click the links in the mail - it’s getting hard to tell the scam mails from the real ones if you just look at font and spelling and not the address that links open.

Navigate to apple support site from https://apple.com

The main problem is if you don’t keep good records of all your security information when you signed up, you might need to be patient and dig up app purchases, review old credit cards systematically and work with support.

A typo in a year is something a computer won't validate and you know the year you were born, just that might not be what the keyboard typed. Worse, if you made up answers or answered the correct question in the wrong field (answer in the field above the question instead of below the question), you could easily lock yourself out.

That ends the thing you control, here are things you don't control:

There’s no way you can prevent someone else from trying to lock your account initially or even take it over. Until you validate to Apple support that you are the owner of the account, the account could be "flagged" for extra security. Hopefully it is just someone that is confused and not someone maliciously trying to make your life miserable.

Answer 2

I'm not sure if clicking on the "Use credit card information" choice would have led to this because what I wound up doing was trying to guess what the answers to my security questions could be. After a few times it said I had tried too many times and could either wait until later or reset the questions. From this page, when I clicked on the button to reset the questions it immediately took me to a page showing the last four digits of a card that I did recognize. So I'm going to chalk this up to confusing design, as the original page did not suggest that it was going to help me with a reminder of which card was being asked for, causing me to get stuck on the page.