Sex Toy Reviews
Latest Reviews
When Apple Account Security Locks the Owner Out
Lechery Review October 28, 2026
An apparent account compromise, a frustrating support experience, and a recovery process that left me unable to regain control of an account I hadn't used in nearly a decade.
Today October 26th 2026 has been frustrating experience though first a little backstory.
A decade away from Apple
About nine or ten years ago, I owned an iPhone 4S. It was a small phone, and eventually I dropped it and shattered the screen.
Before Apple, I was a BlackBerry user. I eventually moved away from BlackBerry after becoming concerned about the handling of user information. I briefly gave Apple a try before settling into the Android ecosystem.
Android has its own issues, of course, but that is a story for another day.
I had little reason to revisit my old Apple account. It was a personal account from around 2016, and for nearly a decade it had largely faded into the background.
Then came April.
A year of security headaches
As regular readers may know, my laptop was hacked in April. The incident forced me to reset passwords across my accounts and email services.
The person responsible managed to spend $110 through my Steam account, although that money was subsequently returned. They also attempted to place an order worth approximately $2,000 through Amazon, which Amazon stopped. Another attempted purchase involved approximately $1,400 worth of concert tickets, but by then I had cancelled my cards.
That was only part of what was happening in my life.
April also brought the mass suspension of Twitter accounts, followed by the process of rebuilding my presence on the platform. There was a death in the family, travel for a funeral, and the planning and logistics of an upcoming move.
In the middle of all that, an old Apple account slipped through the cracks.
I'm not going to pretend that every forgotten account is someone else's responsibility. People overlook things, especially when dealing with multiple security incidents and major life events. That is precisely why account recovery procedures matter.
Fast-forward to October 26, 2026.
Four emails that changed everything
At 11:05 a.m. October 26, 2026, I received two emails from Apple reporting changes to my account. My password and date of birth had been changed without my authorization.
There was another detail that caught my attention: the emails listed the time of those changes as 10:05 p.m., which did not match the time I received the notifications. Meaning not the timezone of my last login. which I have done as early as last year for some of my app reviews.
At noon, two additional emails arrived reporting changes to my date of birth and security questions.
I had not requested any of these changes.
I went directly to Apple's website rather than relying on links in the notifications. I used the email-based password-reset process and changed my password.
I then attempted to sign in.
That was when I discovered just how difficult recovering this account was going to be.
Changing my password wasn't enough
Apple asked me to answer my security questions.
There was just one problem: the person who had accessed my account had changed them.
I selected the option to reset my security questions, only to discover that I needed to answer the existing questions before I could reset them.
Think about that for a moment.
The account had been accessed without my permission. The security information had been changed. I had received notifications about those changes, and I had taken steps to change my password.
Yet I still could not regain access because the very information I needed to prove ownership was no longer information I could provide.
Changing the password did not restore my control over the account. I remained locked out, unable to establish what information was stored there or whether the person who accessed it still had access.
And this brings me to a problem with the security-question recovery process itself.
The security-question loop makes no sense
Why should someone have to answer their existing security questions to change their security questions?
I understand the need to verify account ownership before allowing someone to change security settings. That is reasonable. But what happens when someone
has forgotten the answers and wants to change them for precisely that reason?
What happens when an unauthorized person changes those answers?
In either situation, requiring the existing answers creates a circular problem. The customer is directed toward a recovery option that they cannot complete because of the very issue they are trying to resolve.
If someone has forgotten their answers, telling them to provide those same answers before they can replace them isn't a meaningful recovery option. If someone else has changed those answers, the problem becomes even worse.
There needs to be an alternative method of verification.
Security questions should not become a permanent barrier to recovering an account simply because the information needed to pass them is unavailable.
A better process would allow customers to request an alternative verification method, rather than sending them back to the same questions they cannot answer.
An hour with Apple Support
I called Apple Support and spent approximately an hour working through the available suggestions.
The representative had me try numerous things, including steps I had already attempted. Despite the representative being able to see my account, I could not satisfy the verification requirements because I did not know the security answers that had been changed.
Eventually, the conversation reached a dead end.
There was no escalation to a specialist who could review the situation. There was no alternative verification process offered to establish my identity. There was no workable solution to regain access.
The answer, effectively, was that they could not help me.
The final suggestion was to try accessing the account through the iPhone I had owned around 2016.
That would be the iPhone 4S I dropped and shattered roughly a decade ago.
I no longer have that phone available to use. I appreciate that devices can play an important role in account security. A previously trusted device can provide valuable evidence that someone is the legitimate account owner. I also understand why Apple cannot simply hand over an account to anyone who claims ownership.
But a recovery process that depends on a device a customer no longer possesses needs to have an alternative for legitimate owners who cannot meet that requirement.
What exactly is a customer supposed to do when their old device is broken, their security questions have been changed by someone else, and support cannot offer another route?
I even asked Apple to delete the account
At this point, I was not asking Apple to do anything unreasonable. I wanted to regain control of my own account.
However, I also raised another possibility with the support representative.
If Apple could not help me recover the account, could the company simply delete it?
I could not remember what sensitive information I might have stored on that account. I did not know whether it contained financial details, saved payment information, old purchases, or other personal data. Given that someone else had gained access, I wanted the peace of mind of knowing the account was no longer available to them.
That request also went nowhere. I was told that Apple could not do that either.
I understand that account deletion has consequences and that a company must verify ownership before permanently deleting an account. There may also be legal or administrative reasons why some records cannot simply be erased on request.
But this left me without either of the outcomes I was seeking.
I could not recover the account, and I could not obtain the alternative resolution I requested. I was left unable to verify what information was on the account while worrying about what an unauthorized person might be able to access.
That is not a reassuring position for a customer to be in after a security incident.
Am I actually at risk?
Here is where I want to make an important distinction.
Following the April security incident, I cancelled my payment cards and changed passwords across my financial accounts, email addresses, and other services.
I have taken substantial steps to protect myself. Given those precautions, I believe the risk associated with any old payment information linked to my decade-old Apple account is substantially reduced. Any payment card details still stored there should no longer be valid given that cards tend to expire within three to five years.
That does not mean I can guarantee the account contains no useful information to an unauthorized person. I cannot access it to check.
Nor can I independently verify what payment methods, subscriptions, or other services might still be associated with it.
But I am not sitting here assuming that all my current financial accounts are wide open because someone accessed an old Apple account.
I have already done the work to secure my other accounts.
The remaining problem is that I cannot access this one to determine what is there, manage it, or close it.
And that brings me to another reason I am documenting this experience.
Why I'm putting this on the record
I want a dated, public account of what happened, including the unauthorized account changes I received notifications about, my attempts to recover access, my conversation with Apple Support, and my request to have the account deleted when recovery was not possible.
I am documenting that I contacted Apple and sought a resolution, but was unable to regain access or have the account deleted through the support process available to me.
Why does that matter?
Because I cannot currently access the account to review its contents, check for any outstanding services, or manage anything associated with it. I do not know what, if anything, might eventually become an issue.
If Apple were to contact me in the future about an unpaid service, subscription, or other account-related charge, I would want a contemporaneous record showing that I had already reported the compromise and tried to resolve the situation.
To be clear, Apple has not pursued me for unpaid services as of yet. I am not claiming that it will. I am not claiming that an account compromise automatically removes any legitimate financial obligations that might exist.
I am documenting the situation now because I cannot manage an account that remains inaccessible to me.
This article is not a substitute for formal records of my communications with Apple, and publishing it does not itself establish that I am free of any financial obligations. It is a record of the facts as I experienced them, the steps I took, and the assistance I sought.
I would still prefer a practical resolution from Apple. I would like to regain control of the account, establish what information remains associated with it, and close it.
Until then, I want there to be a clear record that I did not simply ignore the problem. I reported it, attempted recovery, asked for an alternative, and was left without a workable solution.
Security should protect the customer, not leave them stranded
To be clear, I am not arguing that Apple should weaken its security measures.
There is a good reason to have security questions, trusted devices, recovery procedures, and verification requirements. Without them, an attacker could simply contact customer support and claim to be the account owner.
The problem is what happens when those existing measures fail to distinguish between the legitimate owner and the person who has taken over the account.
In my case, the person who accessed the account changed the information I needed to get back in. Once that happened, the ordinary recovery process was no longer useful to me.
Apple's published guidance recognizes that unexpected changes to account details can indicate unauthorized access. Its support documentation also describes account recovery options for customers who cannot sign in through the usual methods.
I cannot claim that every recovery route is impossible for every customer. What I can say is that, during my attempt to resolve this particular incident, the support process did not produce a solution that restored my access.
Apple's guidance is available here:
* If you think your Apple Account has been compromised
* How to use account recovery when you can't reset your Apple Account password
My suggestion: Give customers a secure alternative
During my conversation with Apple Support, I suggested a different approach.
Why not create a secure identity-verification process that customers can access through Apple's website or receive through a verified email recovery process?
For example, Apple could offer an identity-verification review that allows a customer to submit government-issued identification, alongside other appropriate evidence of account ownership, for assessment by a trained security team.
This would not need to mean that an ID alone automatically grants access. Any such system would need safeguards against identity theft, forged documents, social engineering, and attempts to take over someone else's account.
It would also need to protect the sensitive information submitted by customers, with clear rules governing access, storage, and deletion of identity documents.
The point is to provide another route when the normal recovery methods have failed.
A carefully designed verification process could help customers establish ownership without relying entirely on security answers that an intruder has changed or a device that has long since been lost, broken, or discarded.
There should also be a clearly explained escalation process for customers who can demonstrate that they have received unauthorized account-change notifications but cannot complete the standard recovery procedure.
Simply being told that nothing can be done is not a satisfying resolution.
No security system can guarantee that every account will be recovered. But customers deserve a clear explanation of their options and a meaningful process for reviewing exceptional circumstances.
Final Thoughts
As of October 26, 2026, I still cannot access my Apple account.
I have changed the password, but I remain locked out because I cannot answer the security questions that someone else changed. that same someone can use those security questions to change the password bypassing the email route.
I have contacted Apple Support, spent approximately an hour following troubleshooting steps, and asked whether the account could be deleted instead.
Neither request resulted in a solution.
I do not know what information is stored in that account. I cannot confidently establish what personal information may be associated with it. And I have not been given a workable path to regain control or obtain the alternative resolution I requested.
For a company whose products and services are built around personal accounts, devices, and data, that is a problem worth discussing.
Customers should not have to choose between accepting a potential account compromise and being permanently locked out of their own accounts without a clear explanation of their options.
I would like to see Apple introduce a secure alternative verification process, provide a meaningful escalation route, and make its account recovery options clearer for people whose security credentials have been changed without authorization.
I would also like Apple to respond to my experience and explain what options may be available in circumstances like mine.
Because the question is not whether account security matters. Of course it does.
The question is what happens when the security measures intended to protect your account leave the legitimate owner unable to get back in.
And in my case, the answer so far has been a frustrating one: I am locked out, my account remains unresolved, and the last suggestion I received was to use a shattered phone from around ten years ago.
