9

I own "mydomain.com" (actually something else!) and have a catchall to receive all emails sent to any [email protected] Earlier this week I received an email from [email protected] asking me to verify annepearson@mydomain.com. This person is unknown to me. I did not verify.

I have now received this email:

Dear Anne Pearson,

The password for your Apple ID [email protected] has been successfully reset.

If you believe you have received this email in error, or that an unauthorized person has accessed your account, please go to iforgot.apple.com to reset your password immediately. Then review and update your security settings at appleid.apple.com

Has this person succesfully greated an Apple ID account with an email address she doesn't own?

If so, what can I do?

Improve this question
0

9 Answers 9

Reset to default
17
+100

I think this may be a phishing. I advise you to check the 3 following key points:

  1. Within the headers of the 2 E-mails you received, verify they are really originating from apple.com .
  2. Verify the included URL is really within the apple.com domain.
  3. Within the headers, verify there isn't any Return-Path: outside of apple.com .
Improve this answer
1
  • Very concise and very good advice - +2 if I could vote twice. (so it looks like it will have to be +100 once I can award the bounty)
    – bmike ♦
    Dec 29, 2012 at 14:59
4

Has this person succesfully greated an account with an email address she doesn't own?

I don't think you can say they successfully created one, as they will never be able to use the email to verify anything sent to it from Apple. Most likely they just accidentally entered your domain name. Is it similar to another more popular domain name? A one off typo?

If so, what can I do?

Smile and imagine how perplexed they are that they never get the verification emails Apple tells them they are sending. They have not taken anything from you or done anything to you. Therefore, there is nothing for you to do.

Improve this answer
1
  • 1
    Gosh - replies are amazingly fast here! Yes i have already mentioned that - my mistake I just received another email and thought it was proof that they had successfuly created an account - apparently not?
    – Bob Steen
    Nov 25, 2012 at 16:07
2

Everything looks to be explainable by someone using your email address as the string for their Apple ID.

This could be an innocent mistake or them wanting you to perhaps consider selling your domain to them by them squatting on your name space for Apple's iCloud service / Apple ID service.

If you don't even plan to use Apple's products or this email address you could simply ignore all the emails - make a rule and just never confirm any account that tries to use that email.

The "what can I do" boils down to if you care if they have an account with Apple using your email? You could fight it, but it will take some time and perhaps writing a letter to Apple to clear things up.

As long as you don't verify that email - it won't work for that person and they will need to provide another email to use that Apple ID. They will have squatted on that AppleID but nothing else. Apple uses a two step email verification process to ensure that someone doesn't accidentally or intentionally get an email that they do not control listed for an Apple ID.

You could also log in and take control of that account but I've not seen Apple spam unverified email accounts and that person will likely tire of manually logging in and sending verification emails to an account they don't control. More likely, they will delete that email from the Apple ID and move on.

Improve this answer
5
  • 1
    If "Apple uses a two step email verification process to ensure that someone doesn't accidentally or intentionally get an email that they do not control listed for an Apple ID" then how did they get the account linked to that address in the first place? I'm assuming that you need an existing account before you can get a password reset email sent for that account.
    – octern
    Nov 25, 2012 at 6:20
  • No - when you create an Apple ID - you can enter any string that isn't taken. I could make a new Apple ID using [email protected] and enter that as a verification email. Apple then sends the verification to ensure that the email not only works, but that the owner agrees to the use. The only check Apple makes is if someone else already is using that exact email or that exact Apple ID. It doesn't care if the domain is registered or determining who actually owns it.
    – bmike ♦
    Nov 25, 2012 at 14:18
  • 1
    I've now received this email from Apple - Your Apple ID password has been reset" - Dear Anne Pearson, The password for your Apple ID [email protected] has been successfully reset. If you believe you have received this email in error, or that an unauthorized person has accessed your account, please go to iforgot.apple.com to reset your password immediately. Then review and update your security settings at appleid.apple.com > I didn't reset it - Should I now be concerned?
    – Bob Steen
    Nov 25, 2012 at 16:02
  • You mentioned that in the question. If this is the only email address on that account you might have to deal with them emails or Apple to clear up ownership of this one account.
    – bmike ♦
    Nov 25, 2012 at 16:05
  • I see. So, if the person is able to reset the password without verifying the account, then the domain owner could have gotten both of those emails (the verification request and the password reset message) without the owner of the account ever having successfully received an email sent to that address.
    – octern
    Nov 25, 2012 at 20:44
2

When I tried to create a new apple ID using my email I was told that an account under that username or email already exists. So when I requested to change password I received an email in Vietnamese addressed to someone else. So I can confirm that someone can create an apple ID using anyone's email address.

Improve this answer
5
  • This was back in 2015. We're days away from 2019. Ridiculous. Or, diabolical. if you're not an Apple customer then you can take a hike. If you are then it's groovy.
    – Thufir
    Dec 27, 2018 at 11:35
  • @Thufir This answer was also written in 2015.
    – CATboardBETA
    May 3, 2021 at 17:41
  • are you saying that no one can create an apple id of any shape or form with someone elses e-mail @CATboardBETA ?? because so far as I can tell that was the situation and no doubt is the situation. I'd like to create an account with my e-maill address. Mine. As I cannot possibly know the phone number which was used when creating that account I can't "verify" that it's my e-mail account. Obviously, it is.
    – Thufir
    May 22, 2021 at 3:39
  • @Thufir No, what i'm saying is that an answer written in 2015 was obviously relevent is 2015. Just because you are reading an answer years later doesn't change that. The Apple ID creation process has changed on multiple occasions throughout the years, and Naxim's answer was in fact once the case. Perhaps actually check the date an answer was written before talking about how it was only the case 4+ years ago.
    – CATboardBETA
    May 22, 2021 at 13:17
  • While the Apple ID process may have changed, the fundamental problem has been widely reported and widely "debunked" for a very long time. Despite being "debunked" it keeps getting reported somehow. Must be alot of hacked e-mail accounts, as that's the general explanation. Has Apple ever even acknowledged the reality that e-mail accounts have been erroneously registered to Apple ID's? Have they ever offered a solution? If your answer to either question is yes, please do elaborate.
    – Thufir
    May 23, 2021 at 19:38
2

I just had a similar experience and got off the phone with a rep from Apple and they said there is nothing they can do to help. Any email account can be used to sign up for an apple ID if it has not already been used as an apple ID, so someone used my other email account, not linked to Apple as their ID log in name. Their email is the emergency email and only they know the security questions to make changes to the account and if you forget the security questions, Apple sends an email to the emergency email, not the main email, so this guy will get that email and will still be in control of the security questions required to make changes. So Apple could do nothing and this guy is allowed to use my email as his apple ID as long as he wants and I will receive emails from Apple when he uses his device, etc. I did change the password to my email account, in case it was hacked and to the Apple account, so unless he resets it with his backup email, he can't get in and I will play that game until he gets so annoyed he stops using my email address. He probably has a credit card assigned to the account, but it is not my card and I can't access those areas to see because you need to answer the security questions. It's a catch 22 and is super annoying.

Improve this answer
1
  • You have done all you can unless you get a lawyer involved. If your lawyer sends a mail to Apple explaining that the account is falsely impersonating you - you can surely force them to stop using your email but you might not ever get control of that AppleID.
    – bmike ♦
    May 3, 2021 at 18:59
1

Most likely you answered your question in the very first sentence of your question, and the likely answer is that such email address doesn't exist. Typically catch-alls catch only messages sent to non-existing email addresses at the domain. If your catch-all is configured that way (and that's the default setup for all email services that I've seen), the fact that the email message ended up in the catch-all mailbox means that no such email address exist.

As for the source of that email message -- it was already suggested that either somebody mistyped it or is some kind of phishing attempt.

If your catch-all mailbox catches all emails received at the domain, even the ones sent to legitimate email addresses, that's another story (I haven't seen such setups, but they are possible). In that case, it is not clear if such an email address exist. To check, disable the catch-all, send email to the email address and see if it bounces.

Improve this answer
1

According to Apple Support, you can guess the security questions or use a different email. They could verify for me that the account never verified the email (in the 7 years since it's creation), but they have no capacity to unlink the email address.

Apparently you can squat an apple id for any email address regardless of whether you have access to it and Apple can't do anything to resolve this.

Improve this answer
0

This just happened to me. Some guy accidentally created an Apple ID using my email address. He absolutely did not have access to my email.

I was able to reset his password by guessing the answer to one of the silly "security questions". I then logged on to his account, checked the phone number on the IPhone connected to his account and called him. He was a bit surprised.

Now I'm just wondering: why on Earth does Apple allow you to create an account without verifying the email?

Improve this answer
0

I experienced the same problem today. I contacted the support team and I can confirm, apple (at least for a while) did not care to verify that requestor owns the email of the proposed Apple ID name. This means that who first register its device wins the ID and no matter who really owns the email address of that ID. I think this is a quite dangerous choice in terms of personal security and sensible data threatment.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .