With hackers going wild, and I had to spend 2 hours with Apple to reset password and remove payment info from my AppleID account. What is Apple doing to protect us? How does someone access my device in order to attempt to change my password?
Mac mini, macOS 10.14
See the security and phishing/scam-related documents below:
Learn about Phishing, Scams, Apple Practices,etc.
See If you see apple.com/bill, itunes.com/bill, or an unfamiliar charge on your statement https://support.apple.com/en-us/HT201382
See Identify legitimate emails from the App Store or iTunes Store https://support.apple.com/en-us/HT201679
See How to avoid scams when using Apple Pay to send and receive money https://support.apple.com/en-us/HT208226
For scam related information from Apple including reporting scams to Apple see Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams https://support.apple.com/en-us/HT204759
Identify scams related to purported apple notifications—per Eric Root.
“Apple will always address you by your name or the name they have on file for you, not Dear Customer, Dear Client or by using your e-mail address. The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple emails won't have poor grammar/misspellings. Apple e-mails will never contain an attachment. Apple will never request personal information by email such as Social Security numbers, your Mother’s maiden name or full credit card numbers. …
The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.”
Learn about/Increase security
See If you think your Apple ID has been compromised https://support.apple.com/en-us/HT204145
Increase the Security of your Apple ID https://support.apple.com/en-us/HT201303
iCloud security overview https://support.apple.com/en-us/HT202303
Ways to keep your information safe on Mac https://support.apple.com/en-gb/guide/mac-help/mh11402/mac
Use Two-factor authentication for Apple ID https://support.apple.com/en-us/HT204915
Also note that if you are using two-factor authentication, you can Check your Apple ID device list (https://support.apple.com/en-us/HT205064) and remove any device that shouldn't be signed in using the steps in the link.
_______
They didn't access your device. They hacked into your iCloud account. Meaning, it's either someone you know who also knows your user ID and password, or you used an easy to break password.
Apple can't do anything about weak passwords. It's your responsibility to keep people out of your account who shouldn't have access to it. They also can't do anything about users who willingly give out this information in response to spam emails/texts, fake App Store purchase notices, etc.
security
