Apple ID /Facetime account hacked? [duplicate]

Question

About a week ago, we received a Facetime call from our own email address and it was a complete stranger. Then a friend of ours got a Facetime call with from our email address and they missed the call, so they tried Facetiming back and they got this same stranger. This person Facetimed me again, and I confronted him and hung up. Then he messaged me on my iPhone. How could this happen? What happened? Did he hack our account? We have since changed our apple id password, but how could this have happened? Is changing our password enough? Would he still have access to our information?

Answer 1

Apple ID Security:

First, someone knowing your Apple ID password could have devastating results. This is because, if they know your Apple ID username and password and you have Find my iPhone enabled, they can remotely wipe your devices, and literally claim your device. Security of an Apple ID should be of utmost priority. They can also purchase content with your credit card (if you have one on file), and such.

With that in mind, Apple has done several things to increase security of Apple IDs. When you set up an Apple ID password, they have very good restrictions that encourage you to make a strong password. In addition they have 3 security questions. If you have done almost anything with your Apple ID in the past 6 months you were probably prompted to set up these questions. "Do something with your Apple ID" could be anything from purchasing content, to download apps, to logging into your Apple ID on a new device.

All that brings me to the point that unless someone knows you, or, has access to quite a bit of your personal information, it would be very difficult to hack an Apple ID as it is setup right now. I am in no way, stating, or implying, that your Apple ID was not hacked. I am just saying that the process would be difficult.

In addition, you will receive an email confirmation when a new device is registered with Facetime. For example, when I purchased a new MacBook Pro recently, I signed into Facetime, then received an email to my Apple ID email address that stated that my new MacBook Pro was now registered with my Apple ID account(Facetime). To the best of my knowledge this happens any time a device is signed onto Facetime initially. If you haven't received such email, it would seem there is a possibility that your account wasn't hacked. Again, I am not saying either way, just a question mark about what happened.

What may have happened:

Without you sharing more info, there are a couple things that could have happened:

1. Your account was hacked.
   • But why would someone Facetime the person whose account they hacked into? From what I've heard, hackers like to remain anonymous. Again, this doesn't mean it didn't happen, it just would just be odd.
2. Somehow, might it be possible that it, in some way wasn't your email address? Perhaps it is just a one letter different?
   • While this may, at first glance, sound like a likely option, it really doesn’t make much sense either. How would this stranger happen to get your email address (slight character or two different then his) and your friends?

I guess that is to say I'm not really sure what could have happened. If he hacked your Apple ID and found your friend's info from that, then he could have downloaded, via iCloud, all your contacts(or any other data stored in iCloud(Like a whole device backup)). This is truly a worst-case scenario, and could have very undesirable, and far-reaching affects.

What you can do:

Log on to appleid.apple.com and:

1. Change your password.
   • I know you have done this already (you could always do it again), and although it seems obvious it is a critical first-line of defense. Use reliable software to generate a long alpha numerical password. Maybe 14 characters long. Be sure to write it down on paper and secure it somewhere.
2. Consider changing your security questions. Did you know you can use anything (like passwords) instead of real answers for security questions?

Lastly, you could consider changing email addresses. Setup a new email address (like Gmail and enable two-step verification), and link it with your Apple ID when you manage your Apple ID. Also unlink, if you have already, and don't link, if you set up a new email address, your Apple ID email address with Facebook, Twitter or other social services. Consider setting up a separate account for the recovery email addresses for those services.

Answer 2

Well, I guess changing the password would be enough. Just be more careful when it comes about passwords, 'cause it's kinda difficult for somebody to hack a password like that, unless you've told it to the person or this person knows the answer to your secret question.