Separate symptoms from evidence
Battery drain, heat and slow performance can have ordinary causes. More useful evidence includes unfamiliar account sign-ins, messages you did not send, unknown applications or changes to recovery details. Record the time and exact symptom instead of assuming that every unusual notification proves a compromise.
Secure accounts from a trusted device
Open the account provider's official settings directly. Review signed-in devices, recovery information and recent activity. Change compromised credentials and enable an appropriate second factor. If you cannot regain access, use the provider's recovery process. Apple publishes specific steps for suspected Apple Account compromise.
Review the phone itself
Install available system updates and review installed applications and permissions. Investigate unfamiliar device-management settings with qualified help, especially on a work-managed phone. Do not install a cleaner or security app promoted by a scare message. Account compromise and device compromise may require different remedies.
Know when to escalate
- Preserve screenshots of relevant alerts without exposing private codes.
- Contact the mobile carrier if service or SIM access changes unexpectedly.
- Use your organization's support route for a managed device.
- Before resetting, confirm access to backups, recovery accounts and any evidence you need to retain.
For device-specific or current product instructions, see Apple: suspected account compromise.
Need help with your own device?
Describe the problem with the model, symptoms and checks already tried. For related help, explore computer service or remote support.
