Lizziej1 wrote:
My husband has received an email that his Apple ID password has been changed. How do I know that that is not a phishing or malicious email and it is truly an email from Apple?
You would ask your husband whether they’ve changed their password.
Note: In a legitimate password-change or unrecognized-login notification message, the displayed IP geolocation can be off by hundreds of kilometers or more, but the timing should match the password change.
If your husband did not change their password, then there are a few options:
- They don’t have two-factor enabled, and an adversary did change their password. That would be bad. Time to try to claw it back.
- They do have two-factor enabled, and didn’t get a verification code, or didn’t provide a code, so no change was made. The message is likely phishing.
- It’s phishing. Usual ways to spot that involve previewing the embedded links for Apple or not-Apple domains (that’s using link preview, and not following the links!), or reviewing the mail headers for the source of the message.
If two-factor authentication or security keys or some other such second factor is not enabled here, go enable that now. That second factor can provide a last-ditch means to avoid an account take-over after a password compromise. And change the Apple ID password to new and robust and unique value.
Read the following, and run Safety Check: Personal Safety User Guide - Apple Support
Also: If you think your Apple ID has been compromised - Apple Support
There’s also the potential here that y’all are sharing an Apple ID, and that is ill-advised, discouraged, and too often a source of problems and data conflation.
