An iOS a popup just occurred that says someone tried to login from a city I do not recognize. In the past, I have changed my password when this has happened - but despite using a unique, multi-character password - these popups have occurred at least half-a-dozen times.

Posts from Apple such as referenced on this SE question mention that you should refuse requests you do not recognize. They also say you should change your password frequently - but what they don’t mention is whether it is very important to change your password every time.

Do these two-factor pop-ups only occur when someone has guessed your password? If you simply refuse the two-factor approval - does the “bot” or whatever hack you still know your password? And does that mean you should change your password every time this happpens because someone was able to figure it out? Or is there another interpretation and the account is actually safe by just declining their login?

  • I think that the key word here is tried. If they had actually logged in you would get an email to that effect, assuming OP is relaying the message accurately then they did not get in, they only TRIED to get in. Mar 13, 2019 at 11:42

1 Answer 1


There are a number of valid reasons why this could happen:

  • You're using a VPN service that is causing you to show up in a different city
  • You're being incorrectly geolocated to another city broadly within your region of the world.

Aside from that though (and assuming it's not a phishing message you see), it seems that someone is getting your password, and not only should you be changing it, but also trying to figure out whether you've got a keylogger, are getting phished, etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .