Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

iTunes account hacked

Jsameds said:
Glad you sorted it. Sadly it looks like they're getting better at hacking accounts - when they hacked mine they didn't change the questions.

Weirdly Apple never gave me the option of using the serial numbers, they out and out said there was absolutely no way at all to unlock the account if I couldn't answer the questions correctly, which was a pain because I really struggled to remember what I put as the answers because I set up the account nearly a decade ago.
Click to expand...


They initially went down this root asking me the questions but some of them i knew i would never choose like 'What's your fav childhood book?' Also the questions were coming up in Chinese so they figured the questions were changed. Apple said someone was able to get into my email account (yahoo) and managed to reset the account or managed to guess my security answers.

They also advised it was a good idea to use a rescue email so in the event of a hack you can reset the security questions yourself.
 
Nopei didn't have 2 step enabled. I had it for Paypal, Dropbox and mistakenly thought i had it for itunes
 
maka344 said:
Again, did the poster have 2step enabled before the hacking?

My Apple password is complex and not re-used anywhere else, also I have 2step enables. My data is more important than a credit or them downloading music.

Remember, they have access to backups, pictures, emails and iMessage - not a good situation to be in!
Click to expand...

If people are using iCloud and and have everything tied in with their iTune account,then it just stands to reason if in is hacked and we see it can be hacked,then your going to have problems.
 
Nowadays, if an account is tied to a payment method, or is just important, one should always enable two factor if available. It's just the world we live in now.

Shadowbech said:
This. After reading this thread, I bit the bullet as well and enabled the 2 step as well.
Click to expand...
 
digitalcuriosity said:
If people are using iCloud and and have everything tied in with their iTune account,then it just stands to reason if in is hacked and we see it can be hacked,then your going to have problems.
Click to expand...

Exactly! At first i was thinking damn they stolen all my money but then the possibilities seemed endless. They could download all my pics, contacts, know where i live based on my device locations using icloud etc. Its made me question the whole security thing with Apple.

In this case i think they were after the funds as they drained the account within 20 mins. I also entered multiple wrong passwords using the email address they changed it to which resulted in the account being locked down for 8 hours.
 
nwlondonlad said:
Exactly! At first i was thinking damn they stolen all my money but then the possibilities seemed endless. They could download all my pics, contacts, know where i live based on my device locations using icloud etc. Its made me question the whole security thing with Apple.

In this case i think they were after the funds as they drained the account within 20 mins. I also entered multiple wrong passwords using the email address they changed it to which resulted in the account being locked down for 8 hours.
Click to expand...

I wonder if the dealing with your credit cards and banks, in the UK are different then in the USA?
What safe guards do the credit card companies and your banks use in UK?
 
nwlondonlad said:
Woke up this morning and seen a pop up on my iPhone asking me to verify my apple ID, entered password and it said incorrect, hmmm strange. Checked my email and have seen that someone from China has managed to hack into my itunes/app store account changed my password and spent all my app store credit £51

To make matters worse i can't even access my itunes account cos the person has changed it to their email. When i enter my username/email address it says this user does not exist. Contacted Apple support (UK) but they closed for New Years day.

Any advice would be most welcome
Click to expand...
Very similar happened to me. Without the two-factor code you are likely screwed. I was dispairing of ever fixing it when I dug through a safety box and found mine. Immediately changed password. No pers info was changed but the vector is to repeatedly attempt a login which locks account. You better have that verification code.
 
  • Like
Reactions: I7guy
Paco II said:
Nowadays, if an account is tied to a payment method, or is just important, one should always enable two factor if available. It's just the world we live in now.
Click to expand...
Must point out as REPEATEDLY made clear by Apple senior support advisors as I threaded my way up level by level, call by call, case number by case number as I wrangled with my locked account...two factor and two-step are different. Two factor is default, that's the code they text you often to identify a device and so on. Two step is a monster, it's the nuclear option you unleash when you activate it. That is the only way to bring your Apple ID, iCloud, etc. back to the living after for 1 of several reasons your account gets locked. Parties unknown had tried multiple incorrect logins and forced an account lockout. I had forgotten I had activated two-step long ago and was clueless where I had saved the code. So after about a month and a half of panic, seized up iOS and app updates, etc. I found the code and worked like a charm. Actually it's a good thing. Just DO NOT FORGET YOUR UNIQUE RECOVERY CODE.
 
DailySlow said:
Must point out as REPEATEDLY made clear by Apple senior support advisors as I threaded my way up level by level, call by call, case number by case number as I wrangled with my locked account...two factor and two-step are different. Two factor is default, that's the code they text you often to identify a device and so on. Two step is a monster, it's the nuclear option you unleash when you activate it. That is the only way to bring your Apple ID, iCloud, etc. back to the living after for 1 of several reasons your account gets locked. Parties unknown had tried multiple incorrect logins and forced an account lockout. I had forgotten I had activated two-step long ago and was clueless where I had saved the code. So after about a month and a half of panic, seized up iOS and app updates, etc. I found the code and worked like a charm. Actually it's a good thing. Just DO NOT FORGET YOUR UNIQUE RECOVERY CODE.
Click to expand...

I actually didn't have 2 step set up when this happened, just password and security questions. Its been resolved now but i have to wait till the 5th of Jan before i can set up 2 step. Its a standard process after an account has been hacked as they need to be 100% sure that the account is yours. I have set it up on my gfs account and have kept that unique recovery code safe
 
digitalcuriosity said:
I wonder if the dealing with your credit cards and banks, in the UK are different then in the USA?
What safe guards do the credit card companies and your banks use in UK?
Click to expand...

Luckily i didn't have any credit cards associated with my account just store credit. In the UK your protected if you didn't make the purchase
 
One thing to consider is whether they:

a) hacked your email and used that to gain access to your account
b) hacked another company you are registered at that also has the same username and password. I.e. if you registered at adobe (which was hacked a while back) and used the same email address password combination which would allow them to try that combination at iTunes.
 
I also just 2FA my primary iTunes/AppStore account because of this thread. My situation is my iTunes/AppStore account uses one Apple ID (Own .com Domain) and my iCloud Sync for (Calendars/Contacts/Safari/iCloud Drive etc etc) uses another ID (@me.com) so I can't use my trusted devices to 2FA my iTunes/AppStore, only SMS Phone Number.

Apple seriously need a method to merge ID's so we can secure 2FA multiples ID's using the same trusted iOS device.
 
Seeing this happened, would it be wise to change the payment method from my debit card to credit card?
 
Add me in to the list of people enabling two-step... except I somehow can't get my security questions right so I haven't enabled it yet as I ran out of attempts.

Argh.
 
1. Reset your email password and secure that.
2 step if possible.

2. Contact Applecare worldwide if your local area is closed.

3. Reset password if possible.

4. Reset security questions if you forgot them.

5. Enable 2-step authentication or 2 Factor if using iOS 9/El Capitan and invite received.
2 step requires a recovery key.
2 Factor does not.

6. Use an iCloud.com alias which can never be changed or removed.

If your ID has been hijacked, the only way to reset the questions is via access to a rescue email address or answering the current questions.

Ensure rescue address is also secure.

If using 2 step/factor, ensure your SMS and devices are secure.

Applecare does not keep a record of your original questions.
The language may change but questions remain the same if not reset.
 
navaira said:
Add me in to the list of people enabling two-step... except I somehow can't get my security questions right so I haven't enabled it yet as I ran out of attempts.

Argh.
Click to expand...

let me get this straight... you can't get your security answers straight, but the chinese hackers can? because there are multiple reports of security questions being changed.

something is fishy here. appel database was hacked???? or you can bypass all of this with some email recovery?
 
digitalcuriosity said:
If people are using iCloud and and have everything tied in with their iTune account,then it just stands to reason if in is hacked and we see it can be hacked,then your going to have problems.
Click to expand...
Obviously. This is why Apple started offering two-step verification a few years ago. It really locks it down. Your Apple ID/iCloud account is very secure if you use two-step. The OP was not using it at the time he was hacked. Some people consider the extra security (extra steps to access your own account) a bit of a nuciance and would rather not enable it, so Apple offers a choice.
 
b0fh666 said:
let me get this straight... you can't get your security answers straight, but the chinese hackers can? because there are multiple reports of security questions being changed.

something is fishy here. appel database was hacked???? or you can bypass all of this with some email recovery?
Click to expand...
Nooo, I'm not the OP! Apparently I can't remember what was the first album I bought. Guess I put it as "Artist – Title" and I tried "Title" and "Artist - Title", or something. Pretty sure there's nothing spooky about it.

I'll have to call Apple tomorrow to get it re-set.
 
A tangent but related - a few years ago I switched to using 1Password. Everything I need stored in one super secure database. I always use fake answers to security questions for extra security. Everything kept in 1Password for easy retrieval. Nothing is forgotten since I don't have to remember it, other than one strong password. I don't work for the company in any way. But moving to a password manager massively improved my online security and eliminated situations such as the below quote.

navaira said:
Nooo, I'm not the OP! Apparently I can't remember what was the first album I bought. Guess I put it as "Artist – Title" and I tried "Title" and "Artist - Title", or something. Pretty sure there's nothing spooky about it.

I'll have to call Apple tomorrow to get it re-set.
Click to expand...
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back