My Apple ID keeps getting locked

You just need to change your Apple ID email to one that has not been used as an Apple ID before. You don't need to abandon any of your prior email addresses and can continue to use them to send/receive emails. There is no need to change your phone number.

The problem is not that Apple does not have their security act together, it is because they do take account security seriously and locks your account when another bad actor is attempting to access it. I know you do not agree with this approach, but your Apple ID is in the hands of people/bots that are trying to get into your account and the resolution is to change it. That is a huge red flag that you are being targeted and I would not ignore it.

glitchNE wrote:

Bill,

I think you're absolutely right.

Apple ignores these discussions and we're left to our own to create a collaborative solution but unfortunately this has to be solved by Apple. This Apple ID I have doesn't have two factor authentication on it. If I thought that would fix the problem I'd add it but because Apple hasn't responded to these posts I worry that adding two factor authentication would just add a layer of complications to the problem and the problem would persist.

Apple does not respond to post here as this is a user to user support site. If you are looking for support from Apple directly, then you will need to contact them here.

Contact Apple for support and service - Apple Support

If you Apple ID is out there where others are attempting to guess the password and locks you out of your account, then create a new email address and change your Apple ID to this new email address. You can continue to use your previous email address, it just will no longer be your Apple ID.

Change your Apple ID - Apple Support

The answer is simple. Change your Apple ID to a new email address. There is no data loss!!

Change your Apple ID - Apple Support

There is no reason to give out your Apple ID and would recommend to use a different email address for any service other than Apple. If using iCloud+, you are given the option to use Hide My Email, to create your own email addresses that can be easily managed.

That is all that needs done and the problem is solved.

You may have information that has not updated correctly on all devices and services. If you still have problems with persistent password requests or locked accounts, read about what to do after [or before] you change your Apple ID email address or password - What to do after you change your Apple ID or password - Apple Support

BillCerniuk wrote:

Unlocked it again yesterday and was locked again within 2 hours.

you know how you know if an e-mail address is an Apple ID? It turns blue when you use it as an address in iMessage. That’s when the system exchanges the crypto certificates and confirms the ability to send a DM to the address.

So you are left with 2 choices:

• Continue to wait and see if Apple changes anything and get locked out of your account multiple times a day, making it basically useless and being incredibly frustrated.
• Change your Apple ID to a different email address. You continue to use your previous address for everything else, other than your Apple ID. You no longer get locked out. It's simple! I would not recommend using an @iCloud email address as your Apple ID. Change your Apple ID - Apple Support

It is fine to say you shouldn't have to change your Apple ID email address, but refusing to do it, because you say you shouldn't have to and still complaining about being locked out constantly everyday, is not a path I would choose. It makes no sense.

They are not useful.

Apple's AppleID authentication system is vulnerable to end user Denial Of Service attacks on individual accounts. The result is the locked account issue we are discussing here. All someone has to do is create an automated script to try a password on an Apple ID multiple times in some area where there is no "are you a robot" style challenge and they can very effectively lock your account multiple times a day.

I just unlocked my account and based upon the prior 36 prior times, I expect it to be locked again shortly.

I suspect that if someone does an AppleID DOS on an exec at Apple this will get fixed 😉

They don’t need your password to lock your account. All they need is your Apple @icloud.com, @me.com or @mac.com e-mail address associated with your Apple account and they use that to repeatedly try bogus passwords. After a certain number of attempts this will lock your account.

I have been having the same issue with my Apple ID. My account gets locked on a daily basis, sometimes 2x a day. According to several discussions on various forums, this exact problem started for many users in September/October of 2020. Even more in November 2020. People thought it might have to do with 2FA, but people with 2FA and all the latest Apple products and operating systems started having this problem, so that wasn’t the fix.

Prior to then, I was never locked out. There was a period of time when weeks went by without getting locked out, and I thought the problem got fixed in one of the iOS upgrades, but then the problem returned. I’ve noticed that I get locked out any time there is an iOS upgrade or some activity on the Apple System Status page. It isn’t exclusive to that, but it’s a guarantee that it will happen. Six months ago, it got really bad. I also noticed that, six months ago, my rescue email for my account started getting spam. I use that email address exclusively as my rescue email for my Apple account; nothing else. All of this may be a coincidence, but the coincidences are starting to pile up, making me believe this is something on Apple’s end that they have not yet fixed.

[Edited by Moderator]

It’s not a local machine problem, it’s an Apple service security problem. It’s somebody trying to log into your account multiple times (without success) causing the Apple “security“ to punish you by locking you out.

imagine having somebody try your front door multiple times at which point your front door is programmed to not let you in the house and you have to then call a locksmith. That’s a method of security that has been deployed on Apple iCloud systems.

The proper way to do this is to inhibit the perpetrator by locking their IP address out from Apple servers (say for 20 min after 8 tries from the same IP) when they pull this nonsense. In this way, it dissuades the bad actor, and doesn’t punish the customer.

If your Apple id Keeps geting locked I suggest that you Contact - Official Apple Support to get further support on the issue

Did you resolve this?

I am experiencing the same problem. I assume my old login & password was leaked, and various hacker’s attempts to use those old credentials from a dump somewhere to log in is triggering my account to become locked.

After a long call with senior Apple support, there is apparently no solution to this. The only resolve is to de-activate the account and start afresh.

in my case I have at least two geriatrics, one in England, the other in Canada, who think that they can arbitrarily use and claim my e-mail as theirs

I also have this issue. 3 Americans, English and Canadians think my email address is theirs. I get alot of their correspondence. They think my emailaddress@me.com email address is their address emailaddress@icloud.com.

My issue is either a brute force attack or one of these members of our elderly generation has my email address constantly trying to log in on some device somewhere.

Infuriating. Apple should be able to block IP addresses that are attempting to sign in.

My fix for this as I mentioned before is to sign in with passkey. Even if your account is locked when you log in with passkey and provide a face id scan from your phone it will simaltaniously unlock your account and sign you in.

I have not had the issue since I started signing in with passkey instead of password.

I know people with 20+ year old accounts and no 2 factor and they don't have issues with their accounts locking. It could be it is because you are not using two factor that the account locks. Somebody is trying to hack your account and causing it to lock after too many tries. Having two factor would mean your account would not lock (but you might get a lot of texts with verification codes).

I have been a developer using ASM, Pascal, and C as well, so we are most likely about the same age and I think you would agree that 15 years ago the best security we had for the accounts was "What is you mother's maiden name?". We did not have to worry about bots doing brute force attacks on our account and to be honest our accounts stored very little valuable information.

Apple has made the decision to lock the account after too many failed attempts. You can dispute what should be counted as a failed attempt to trigger the lock:

• Should it be only if the wrong password is detected?
• Should it be only if the wrong verification code was used with 2FA?
• If you receive a verification code by the action of a hacker accessing your account, should you be able to deny the request so it does not count as a failed attempt?

In any case, I would be concerned that my Apple ID is in the hands of someone that has bad intentions and would want to change it to a different email address. That would solve the problem and I would not use that same email address on any other site.