Account compromised or paranoia?

Question

Level 1

9 points

Account compromised or paranoia?

Im just wondering if there is a reasonable explanation that might put my mind at ease after a few days of being neurotic.

Basically after noticing a device I had thought Id removed had reappeared on Icloud I became a little paranoid. I removed the device, changed password etc. I then also requested a copy of my data from apple to see what I could discover.

I sort of wish I hadn't as the 'Apple ID SignOn Information' (basicaly a log of the last time icloud etc logged on with apple id) revealed numerous strange IP's that definitely were not me. Two of which were in a different country (Netherlands)! This of course freaked me out further!

It didn't quite add up though. My passwords are fairly strong and the two factor authentication was on. Id not been alerted to anything. I cant even get onto icloud myself without having to enter codes and receiving emails. Surely logins in several countries at the same time would have triggered something?

I dug a little deeper however and discovered that the time stamps fitted exactly when I had logged onto icloud etc to try and secure things. But they were in no way my IP. Totally different ISP and locations. Is there some non hysterical explanation? Some sort of network quirk of that particular log?

I don't really want to have to try and explain all this to a call center and apple wont let me do it any other way so I thought Id see if anyone had any thoughts?

Posted on Mar 24, 2019 1:04 PM

Reply

Answer 1

Top-ranking reply

CarlAVII

Community Specialist

Mar 25, 2019 2:16 PM in response to chris123_m

Hello chris123_m,

Welcome to the Apple Support Communities. I saw your post, and I'm glad to assist as much as possible.

To clarify one point, do you recall seeing any two-factor authentication prompts from around the time of these sign-ins? The location shown in two-factor authentication sign-in prompts is approximate based on your connection, as covered in the resource titled: Two-factor authentication for Apple ID

What if I don’t recognize the location shown in my sign in notification?

When you sign in on a new device, you’ll get a notification on your other trusted devices that includes a map showing the approximate location of the new device. This is an approximate location based on the IP address the device is currently using, rather than the exact location of the device. The location shown might reflect the network you're connected to, and not your physical location.

If you know you’re the person trying to sign in but you don’t recognize the location shown, you can still tap Allow and continue signing in. However, if you ever see a notification that your Apple ID is being used to sign in on a new device and you're not the one signing in, tap Don’t Allow to block the sign in attempt.

It's great to hear that you already have two-factor authentication enabled. If you don't believe the information above applies to what you've observed, I recommend getting in touch with Apple. You can do so using this link: Contact Apple Support

I hope this helps to answer your question.

Take care.

Reply

Account compromised or paranoia?

Similar questions