My account was taken over due to sim swap scam with my carrier. The number has now been changed, and recovery key added. Are there any steps I can take to 1. force apple to suspend and preserve the account? and 2. force apple to at least let me retrieve my 16 years of icloud data, including priceless family photos and memories?
iPhone 17 Pro, iOS 26
Hello stolen_account_help and welcome to the Apple Support Community.
A SIM-swap takeover is serious. The key point is who controls the trusted devices and the 28-character Recovery Key.
→ If any trusted Apple device is still signed in:
• Do not sign out, erase, or reset it.
• Change the Apple Account password, remove unknown devices or trusted numbers, and try to replace or turn off any Recovery Key you did not create.
• Immediately download or export irreplaceable iCloud data, especially Photos.
If you created the Recovery Key after regaining control, keep it safe. If the attacker added it and you no longer have a trusted device, Apple states that a Recovery Key disables standard account recovery; without that key, the account can become permanently inaccessible.
Apple’s public documentation does not describe a consumer procedure that lets Support place a “preservation hold” on a compromised account. Contact Apple Support immediately to document the takeover and secure any remaining access. Also secure the carrier and email accounts linked to Apple.
If you can still authenticate, request a copy of your data through Apple’s Data & Privacy tools and download your iCloud Photos. These tools do not bypass Apple Account security.
If you contact Apple Support, please return and tell us what they advise and whether access or the data is recovered.
🙏
Have a good day
And one more thing…
Never forget to think different.
Important:
• Always check that your Apple devices and apps are updated to the latest available versions.
• The latest public iOS version verified for iPhone 17 Pro is iOS 26.6.1. Check Settings > General > Software Update.
Useful links:
If you think your Apple Account has been compromised – Apple Support
Set up a recovery key for your Apple Account – Apple Support
It is not clear how the SIM plays any role at all with your Apple Account. That only gives access for the device on a particular network and the SIM contains no account information.
If you have additional information on what actually happened, we may be able to help further. From what you have posted it is not exactly clear how your account was taken over. It is quite common when not using 2FA, but that has nothing to do with a SIM swap and not sure if you just concluded that is what has happened based on an internet search or an AI response.
Crimes are reported to law enforcement. Apple does not open a criminal investigation on your behalf and report it to law enforcement, but they do work with law enforcement for criminal cases that you initiate and are investigated by law enforcement.
Unfortunately, I had no other devices and have not been able to regain control. As a result of the account takeover and sim swap, the hacker gained access to client data and credit cards. All of my personal information is gone. It's amazing to me that I'm trying to report a crime and Apple refuses to do anything here.....
I agree.
A SIM swap could only cause this if the password was already compromised and they only wanted the trusted number (and assumed that the device’s phone number WAS a trusted number.
Or a simpler scenario:
I suspect 2FA wasn’t on to begin with and password was re-used.
The unauthorized individual convinced AT&T to port my phone number and "device" onto a business account unrelated to ours (and unauthorized). The individual then gained access to apple ID (using my trusted phone number) and reset the password. They then reported my device as stolen and added to a new device. Once in, they changed the trusted number, deleted my recovery contact, and added a recovery key.
Additionally, I have filed police reports, claims with the FCC, and IdentityTheft.gov. I have the transaction record from AT&T where the phone number and device was removed from our account with no authorization or confirmation from us.
Re: “… Once in, they changed the trusted number, deleted my recovery contact, and added a recovery key … “
How was all of this ascertained if they had already changed your Account Password ?
(which presumably locked you out)
Interesting … and truly unfortunate, especially as it didn’t have to happen.
Re: “… I work in accounting and finance, and feel this was a very targeted and deliberate act based on the speed and exact accounts …”
You sound like a good candidate for employing Security Keys for Apple Account; which effectively “Locks Out” your on-file Trusted Numbers for 2FA authentication purposes.
About Security Keys for Apple Account - Apple Support
The “insider” at AT&T is a plausible method for initiating SIM swap.
However “… The individual then gained access to apple ID (using my trusted phone number)… “ HOW ?
You can request a password reset if you know apple ID and have access to the trusted number.
And since AppleID's are email addresses, those are not super hard to guess......
Might I also add... I work in accounting and finance, and feel this was a very targeted and deliberate act based on the speed and exact accounts that were hacked.
I was able to regain control of my email account and received the security alerts in the email.
Account Takeover and Sim Swap
