Why Apple just sent you an Apple ID verification code

Apple ID codes are different from the rest, and worse to receive.

Your Apple ID isn't one account. It's your photos, your iCloud backups, your messages, your keychain of saved passwords, and Find My, which can locate and in some cases erase your devices. Someone who gets into it gets all of that at once.

If a code arrived and you weren't signing in anywhere, treat it as the priority for the next few minutes.

What to do

1. Tap "Don't Allow" and don't read the code to anyone

When the prompt appears on your device, deny it. Then hold that line, because the call is coming.

The Apple ID version of this attack is unusually persistent. After the code fails, the attacker calls, and the caller ID often shows Apple Support. The script is that your account has been compromised and they need the code to secure it. Apple never calls to ask for a verification code. Anyone asking is the person trying to get in.

2. Change your Apple ID password from your device settings

Go to Settings, tap your name, then Sign-In & Security. Change the password there rather than through any link you were sent. Make it unique to this account.

3. Review your trusted devices and trusted phone numbers

In the same section, look at every device signed in to your Apple ID and remove any you don't recognize or no longer own. Then check your trusted phone numbers and remove any that aren't yours. A number an attacker managed to add is a permanent route back in.

4. Check your account recovery settings

Look at your recovery contacts and recovery key. An attacker with brief access may have added themselves as a recovery contact, which is a quiet way to keep a claim on the account after you've reset everything else.

5. Turn on Stolen Device Protection

On iPhone, this adds a biometric requirement and a security delay before sensitive changes like an Apple ID password reset can be made away from familiar locations. It's designed for a stolen phone, and it also raises the cost of an account takeover.

6. Check what the account reaches

Look at Find My for devices you don't recognize, check whether iCloud backups or photos have been accessed, and review your iCloud email for forwarding rules. If you use Sign in with Apple for other services, those inherit the risk from this account.

Why Apple IDs get targeted this hard

An Apple ID is the root of the tree. Email, saved passwords, photos, location, and the ability to reset other accounts all sit under it, which makes one successful compromise worth more than a dozen retail logins.

The password itself came from a breach somewhere unrelated, replayed in bulk. What makes the follow-up call work is everything around it: your name, your phone number, your address, and often the type of device you own.

Data brokers and people-search sites publish that combination openly, gathered from public records and commercial data and sold to anyone. When a caller can recite your address before you've said a word, "this is Apple Support" stops sounding like a stranger and starts sounding like verification.

Delist finds those listings, files the removals, and re-checks them over time, since brokers commonly repost a profile after it's taken down. Run a free scan to see where your details are published.

The wider pattern behind these codes is covered in why you're suddenly getting 2FA codes you didn't request.

Frequently asked questions

Does an Apple ID code mean someone has my password?

Yes, in most cases. Apple sends the verification code after a password is accepted. Change it now, and change it anywhere else you used the same one.

The caller ID said Apple. Was that really Apple?

No. Caller ID is trivially spoofed, and a call immediately after a failed verification code is the signature of this attack. Apple does not call to request codes. If you want to check, hang up and contact Apple through the Support app or apple.com.

I approved the prompt by accident. What now?

Change your Apple ID password immediately from a device you trust, review trusted devices and phone numbers, remove anything unfamiliar, and check your recovery contacts. If you can't sign in, use Apple's account recovery process, and expect it to take time by design.

Why do I keep getting prompts over and over?

That's deliberate. Repeated prompts are meant to wear you down until you approve one to make it stop, or to bury a real notification in the noise. Keep denying them and change the password, which is what actually ends it.

Should I turn off two-factor authentication to stop the notifications?

No. The notifications are the protection working. Turning it off hands over the account to whoever already has the password.