Unauthorized Apple ID password change

[brantlyj]

Twice in the last 3 days my Apple ID password has been changed. I have two factor authentication enabled but I received no notifications other than the email that the password has changed.
Not sure what to do other than making a new Apple ID and deleting the old one. Hopefully someone has an idea on what's going on.

 

[MacInWin]

If it has actually changed, and you didn't change it, how do you log in to iCloud? And how did you find out it had been changed? You mentioned an email, who is it from (you can right click on the "FROM" address in Mail to get the full sender information)?

WARNING: If you abandon the AppleID you have and create a new one, all of the software purchases with that original AppleID will be lost and you will have to purchase new licenses/copies with the new AppleID, in addition to changing it on all of your Apple devices (Mac, iPhone, iPad, etc.).

What may be happening is that you are being spammed by someone hoping to get you to respond to the email so that they can actually get your password, or get you to divulge personal information so they can do further damage. The don't actually have access, and cannot actually change your password, but if you click on any link, or follow their information you would fall into their trap.

 

[Raz0rEdge]

How do you know the password was actually changed? Does your password no longer work to get into your account? If you have 2FA enabled, it should be prompting you, it doesn't get bypassed that easily.

You might be THINKING that it's changed, but not really. A lot of times people will ask for a password reset to get into your account, but it won't go through. I get these sorts of emails all the time.

As long as you can get into your account, you can ignore those emails.

 

[brantlyj]

If it has actually changed, and you didn't change it, how do you log in to iCloud? And how did you find out it had been changed? You mentioned an email, who is it from (you can right click on the "FROM" address in Mail to get the full sender information)?

WARNING: If you abandon the AppleID you have and create a new one, all of the software purchases with that original AppleID will be lost and you will have to purchase new licenses/copies with the new AppleID, in addition to changing it on all of your Apple devices (Mac, iPhone, iPad, etc.).

What may be happening is that you are being spammed by someone hoping to get you to respond to the email so that they can actually get your password, or get you to divulge personal information so they can do further damage. The don't actually have access, and cannot actually change your password, but if you click on any link, or follow their information you would fall into their trap.

I can log into iCloud via FaceID. In the settings area it shows the date of people change.

I tried to log out of AppleID on the laptop but when I get to the spot where it wants the AppleID to log out of FindMy it says it’s incorrect.
The From e-mail is correct.
I also get a pop-up on my phone saying a new Device has been added to my account. However it does not show up in my list of devices.

 

[brantlyj]

How do you know the password was actually changed? Does your password no longer work to get into your account? If you have 2FA enabled, it should be prompting you, it doesn't get bypassed that easily.

You might be THINKING that it's changed, but not really. A lot of times people will ask for a password reset to get into your account, but it won't go through. I get these sorts of emails all the time.

As long as you can get into your account, you can ignore those emails.

I type iCloud.com directly into a browser. When on a phone it uses faceID or your phones passcode to log in.

 

[MacInWin]

In the settings area it shows the date of people change.

What is a "people change?" FaceID won't work if the actual password is changed. The fact FaceID works tells me the password isn't changed.

However it does not show up in my list of devices.

What doesn't show up in the list of devices? Assuming it's the "New Device" you talked about, do you know what type of device it is?

I type iCloud.com directly into a browser. When on a phone it uses faceID or your phones passcode to log in.

What happens if you use a computer to log into icloud.com? Does the password work there?

 

[brantlyj]

Date of

What is a "people change?" FaceID won't work if the actual password is changed. The fact FaceID works tells me the password isn't changed.

What doesn't show up in the list of devices? Assuming it's the "New Device" you talked about, do you know what type of device it is?


What happens if you use a computer to log into icloud.com? Does the password work there?

date of pw change. Autocorrect must have changed it.
Yes, the new device is not there

other than trying to sign out of my Apple ID I did not try anything more on the computer

 

[MacInWin]

I'm sorry, but I simply do not understand what you are trying to say. I'm going to drop out and maybe someone else can assist.

Good luck with it.

 

[IWT]

@brantlyj

Hold fire, as they say.

Your first post does not suggest that your Apple ID was compromised and I see no reason for presuming that; nor the need to change your PW or ditch your current Apple ID. And certainly not create a new Apple ID.

As we are seemingly going round in circles here: why not contact Apple Support by telephone (best) or via Internet (chats are time consuming and one-sided in a way) - or, if an Apple Store is within reach, go there with your Apple products and get them to sort this for you.

I advise this only because each post brings up new concerns and, from my perspective, each one muddies the water.

We are, for sure, dedicated to help you and all others on our Forums, but complications of the sort you have seem better resolved by direct contact with Apple - in my personal opinion.

Ian

 

[Rod]

While Apple will send an email confirmation of a change of password it's hard to understand how, with 2FA it could have been confirmed by the OP. If indeed the account has been compromised contacting Apple asap directly is essential.
Did the email contain a "If you did not authorise" option? I can't remember if Apple does this.