Texts and calls

The Apple ID Sign In Push, October 2026

Updated 21 October 2026

You were on the bus. Your screen lit up with an Apple ID sign-in request from somewhere in another county, and you tapped Allow because you were half asleep. That single tap just handed a stranger the keys to your photos, your Find My, your iCloud backups, and any password you saved in iCloud Keychain. The expensive part is not the photo leak. The expensive part is the moment they sign you out of every Apple device you own and start the iCloud lock, because getting back in is a multi-day fight against a support queue that does not pick up the phone.

What the prompt actually is and why it pops up

An Apple ID sign-in push is the second factor Apple uses to confirm a new login. When you sign into icloud.com, an App Store purchase on a strange device, or iMessage on a fresh Mac, Apple sends a prompt to every device already trusted on the account. Two of those prompts look identical. One is yours, one is somebody else. Apple will not label the city. It will not name the browser. It will not show a phone number. You get a map dot and a push that says Apple ID Sign In Request and an Allow or Deny choice.

The reason this is now a scam vector is that phone numbers leak. Your number lives in the same pile that gets hit by the SIM swap, the port-out text, and the wrong number text scam that opens a long con. The attacker types your email into appleid.apple.com. Apple sends a six digit code by SMS to your number. The attacker texts you from a different angle, posing as Apple, asking you to read the code back so they can confirm it is your device. If you do, they type the code in, the prompt pops on your phone, and they are inside. From there they read your email, find your bank password reset link, change the password, and the rest of the week is yours to lose.

There is a second version that does not need the SMS code at all. The attacker already phished your email password somewhere else. They type it in. Apple sends a push to your phone. You are half asleep on the bus. You tap Allow because you think Apple just double checked. You just approved their login on your phone, with your fingerprint, in front of your face. Same outcome. Different trick.

The prompt is silent. It does not ring. It does not say which device. It does not say which country. The only honest answer when you did not start a sign in is to tap Don't Allow and never think about it again. The expensive answer is to tap Allow because you assume Apple would not ask if it was not real.

What the attacker does in the first ten minutes

Once the attacker is in your Apple ID, they move fast. The first thing they do is turn on a recovery key they control, or add a recovery contact, so that you cannot bounce them out. The second thing they do is sign your trusted devices out of iCloud, which kicks every Apple product you own off the network and starts the activation lock sequence. The third thing they do is forward your mail, because iCloud mail is the reset vector for everything else you have, including the bank.

If you use Sign in with Apple on a third party app, they get in there too. If you use Hide My Email, they can read the relay addresses. If you have an iCloud Keychain entry for your bank, your broker, your crypto exchange, or your email, they get the passwords in clear text the moment they pull the keychain down. There is no second prompt for the keychain. The Apple ID login is the only gate.

Then they wait. The smart ones do not move money the same day. They read your email for two or three days, they map your recurring payments, they read the messages you have not deleted, and they look for the one reset link that lets them drain the account. By the time you realise what happened, the bank thinks you typed the password. The exchange thinks you passed the second factor. The phone company thinks the SIM swap was you, because the port-out text was approved three weeks ago and you forgot.

This is why the prompt feels so small. It is small. The damage is not.

What to do in the next sixty seconds if you tapped Allow

Do not try to think. Move. Open Settings, tap your name at the top, scroll down, tap Sign Out. Sign out of every device listed, including the ones you do not recognise. This stops the session and re-locks the account. It will also kick you off, which is the point. You would rather be locked out for ten minutes than signed in with a stranger for ten days.

Now change the Apple ID password. Use a device that is not signed into iCloud, like a work laptop, so the attacker does not see the reset in real time. Pick a password you have never used. If you have iCloud Keychain turned on, treat every saved password as burned. Start with the bank, the email, the broker, the crypto exchange, and the phone carrier. Rotate those four before you do anything else.

Turn off SMS as a two factor method. Settings, Apple ID, Sign In and Security, Trusted Phone Number, remove the number. The number is the chokepoint. Every reset that matters in your digital life will accept that number as proof, because the phone company already does. The attacker is already inside the chokepoint. Pull the chokepoint.

Generate a recovery key. Write it on paper. Store the paper somewhere a thief in your house cannot find in five minutes, because the attacker who has your iCloud is the kind of attacker who will also try the house. The recovery key is the only thing that beats a stolen recovery contact.

Call the bank. Do not use the number in your contacts, because the attacker has your email and may have edited the entry. Use the number on the back of the card. Tell the fraud team your email is compromised and to require a video or branch visit for any password reset for the next thirty days. Banks do this. They do not love doing it, but they do it.

Call the phone carrier. Ask for a port freeze and a SIM swap freeze in writing. Read the recent port-out and SIM swap logs back to the agent. If anything happened in the last ninety days that you did not authorise, that is the missing piece. The Apple ID prompt is the end of a chain that started with a text you did not notice.

What recovery looks like, and why the queue is so long

Apple's account recovery is the part nobody warns you about. If the attacker has signed you out and changed the recovery contact, the only way back in is account recovery at iforgot.apple.com, which can take three to fourteen days depending on the queue and the proof you can supply. Apple will not help over the phone for a locked account. Apple will not help in a store for an iCloud lock. The store can hardware-unlock an iPhone if you have the original receipt, but it cannot unlock the Apple ID. The two are different locks, and the store only holds one key.

During the wait, you cannot get iMessage. You cannot get iCloud mail. You cannot pull a photo off the phone. You cannot use Sign in with Apple anywhere, which means if you use it as your single sign on for a third party app, you are locked out of that app too. Family Sharing breaks. App Store purchases break. AirDrop stops accepting your devices. Find My becomes useless, which means a stolen iPhone in the same week is now gone for good.

The way to shorten the queue is to start account recovery from a device you have used with the Apple ID for years, on a network you have used for years, and to have a credit card on file that matches the one on the account. Apple uses those signals to weight the request. A recovery started from a new laptop on a hotel Wi-Fi is a recovery that takes the full fourteen days.

If you have AppleCare, call them first. They do not unlock the account, but they can flag the case as fraud, which moves the queue by a couple of days. If you do not have AppleCare, you are in the regular queue. The regular queue is the queue.

How to make sure the next prompt is the one you started

Open Settings, Apple ID, Sign In and Security. Turn on Require Touch ID or Face ID for purchases and for Apple ID changes. This means a prompt cannot be approved with a button press on a locked phone, which means a half asleep tap on the bus does nothing. The attacker is still in, but the prompt is still on the screen, and the only way to clear it is your face.

Remove every trusted device that is not in your hand right now. The old iPad in the drawer. The MacBook you sold in 2024. The work laptop from the job you left. Every one of those is a tap surface for the attacker if they ever recover your password by another route. Sign them all out.

Turn on Stolen Device Protection. It is a setting buried under Face ID and Passcode, and it adds a one hour delay for Apple ID changes when you are away from a trusted location like home or work. The delay is the feature. The attacker who has your phone and your passcode cannot turn off Find My without the delay, which gives you an hour to mark the device lost from another Apple product and lock the account.

Stop using SMS as the second factor. Use a hardware security key, or an authenticator app, or at minimum a second Apple device that is in a drawer and only turns on for prompts. The phone number is the weakest link in the chain. The number is what the port-out text and the SIM swap text and the wrong number text all want. Pull the number out of the Apple ID chain and the prompt becomes a closed loop the attacker cannot reach from the outside.

Finally, assume the next prompt is a scam. If you did not start the sign in, the prompt is hostile, and the only correct answer is Don't Allow and a check of the Apple ID settings page from a different device. Apple will not call you about it. Apple will not text you about it. Apple will not email you about it. The prompt is the only thing Apple sends. If the prompt did not come from a thing you did, deny it and move on.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.