My Apple ID was hacked and 2FA was set up with the attacker’s phone number.
I still control the email address, but the only account recovery method requires verifying that unknown number.
Is this expected? Or how can I recover the account?
Having access to the email address in no way proves you are the legitimate owner of the Apple Account. For a third party email address, each would have their own password. If that was not the case, a compromised email account would also lead to a compromised Apple Account. Each are managed separately so a compromise of one account will not compromise the other and they use their own security protections such as 2FA for recovery.
It is likely you have lost access to that Apple Account and you can create a new Apple Account by using a new email address. We won't have any information on your Support Ticket or what outcome Apple may be able to provide. In some cases they can use additional information such as credit card transactions for verification, but have no way to know if that would be possible on your account.
The normal Account Recovery process is described in this article:
How to use account recovery when you can’t reset your Apple ID password - Apple Support
Maybe you should give the official Apple Support a call and ask what else could be done:
From an earlier version of the account recovery article: https://support.apple.com/118574
"In some cases, you might be able to speed up the account recovery process or reset your password immediately by verifying a six-digit code sent to your primary email address. You might also be able to shorten the wait time by providing credit-card details to confirm your identity. If you’re given this option, an authorization request goes to the card issuer."
I wonder if that telephone number confirmation is related to the above, not required, but would help speed up the verification process?
Hi,
Yes I checked that page.
In my case, it’s an old Apple ID I used only for testing and haven’t touched in years, so there was no 2FA set up and no trusted device linked to it.
On iforgot.apple.com, the only recovery option I’m given is to confirm the hacker’s phone number (only the last two digits show), and there’s no other way to verify.
I found the Apple Support hotline last week and called. After about an hour explaining everything, they opened a ticket, but I haven’t seen any update yet.
I’m just confused because I still control the email address, but it looks like I won’t be able to use it for that (or even another new) Apple account anymore.
Hi,
I get your point. Now the situation is indeed : this email address will never be usable for Apple ID again.
I was wondering why Apple can’t allow unlinking the email from the lost Apple ID so it can be reused for a new Apple ID. I’m guessing there are security or legal/data-retention reasons that make unbinding risky.
We are not privy to why, or why not, Apple does things certain ways. For one, unless Apple decides that the account is in violation of its terms then they may not even close it and your address is blocked because it is still in use.
Even if the account is closed, this probably applies:
From: https://support.apple.com/102559
“Can I use the primary email address for my deleted Apple Account to create a new Apple Account or with another existing Apple Account?
No, once your Apple Account is deleted, you can’t use the email address that you used with it to create a new Apple Account for as long as Apple retains the one-way hash of the email address. For third-party (non-Apple) domain accounts, the one-way hash is deleted after six years. For other accounts, this is retained according to Apple's retention policy, which is reviewed regularly. In addition, you can’t use that email address with another existing Apple Account except as a rescue email. Also, if your primary Apple Account email address is with a Custom Email Domain, it can never be reused to create an Apple Account after your Apple Account is deleted, even if the domain ownership changes.”
Hi,
Thanks. In this case, unfortunately there’s no purchase history and no trusted phone/device on the account, so the only thing I can prove is that I still own the email address.
Otherwise, indeed we could try to provide them to the support ticket.
Recover Apple ID after 2FA set to attacker's number
