Fake "Apple ID locked" emails: how to tell if your Apple Account is really locked

"Your Apple ID has been locked for security reasons. Verify your information within 24 hours or your account will be permanently disabled." This is one of the most common phishing emails in the world, and it keeps working because Apple accounts really can be locked. This guide shows how to check your account in seconds, what a real lock looks like, a real-vs-fake comparison, and what to do if you or a colleague already typed a password.

Is the "Your Apple ID has been locked" email real?

Almost never. An email that says your Apple ID or Apple Account is locked, disabled or suspended, and gives you a link or button to "verify" or "unlock" it, is a phishing email. The link leads to a fake Apple sign-in page that steals your Apple Account password, your verification code and often your card details.

Apple now calls the Apple ID an "Apple Account", and its current help pages use that name. Scammers use both names, so "Apple ID locked" and "Apple Account disabled" are the same scam.

A real lock looks different. Apple's page on locked or disabled accounts lists the messages you see when you try to sign in, such as "This Apple Account has been locked for security reasons" or "This Apple Account has been disabled for security reasons". Apple says a security lock happens automatically, for example when you or someone else entered the password or other account information incorrectly too many times. The fix Apple gives is to reset your password, or to tap Request Access in the alert or go to iforgot.apple.com/unlock. None of that involves clicking a link in an email.

Apple's scam guidance adds a simple rule: "Apple will never ask you to log in to any website, or to tap Accept in the two-factor authentication dialog."

Common versions of the lure

The iCloud version, where storage is "full" and photos will be "deleted", has its own guide: iCloud storage full scam emails.

Example of a fake Apple ID locked email

This is an example written for this guide. It is not a real Apple email.

From: Apple <no-reply@appleid-account-secure.com>
Subject: [Action Required] Your Apple ID has been locked

Dear Customer,

Your Apple ID was locked for security reasons because
someone tried to sign in from an unknown device:

  Device: Windows PC   Location: Bucharest, Romania

To restore access, verify your information within
24 hours. Unverified accounts will be permanently
disabled and all purchases removed.

        [ Unlock Apple ID ]

Apple Support
Copyright 2026 Apple Inc. All rights reserved.

Red flags: a sender domain that isn't Apple's, "Dear Customer", a 24-hour deadline, a threat to remove purchases and an unlock button. The device check below works even when a fake has none of these mistakes.

How do I check if my Apple Account is really locked?

Check on your device, not in the email. It takes less than a minute.

1. Open Settings on your iPhone or iPad and tap your name. If your account page, iCloud settings and device list load normally, you're signed in and your Apple Account isn't locked. On a Mac, choose Apple menu > System Settings and click your name.
2. Or sign in on the web yourself. Type account.apple.com into the browser. Don't copy any link from the email.
3. If you see Apple's own lock alert, follow it. Apple says to reset your password, or tap Request Access or go to iforgot.apple.com/unlock (Apple Support). Type the address yourself.
4. If the email was about a purchase or a payment, check your purchase history in the App Store or in Settings. Apple says genuine App Store and iTunes Store receipts "include your current billing address, which scammers are unlikely to have", and that payment changes should be made "in Settings directly on your iPhone, iPad, or iPod touch" (Apple Support).
5. Forward the fake to reportphishing@apple.com, then delete it.

If everything works on your device, the email was lying. You don't need to do anything else to your account.

Real Apple lock vs fake "Apple ID locked" email

Why the sender address isn't proof

Apple's help pages don't publish a list of the addresses its account emails come from, so don't treat a familiar-looking address as proof. The From name "Apple" costs a scammer nothing (see display name spoofing). Apple's own list of phishing signs starts with "The sender's email or phone doesn't match the name of the company that it claims to be from" and "A link in a message looks right, but the URL doesn't match the company's website" (Apple Support).

If you want to see where a message really came from, paste its headers into the free Email Header Analyzer. It shows the sending servers and the SPF, DKIM and DMARC results. A fail tells you a lot; a pass only tells you which domain sent it, which is why the device check comes first.

Why do scammers send fake Apple ID emails?

An Apple Account opens a lot: iCloud Mail, Photos, Notes, Contacts, backups, Find My, the saved card used for App Store purchases and, through Apple Pay, payment details. A stolen password plus a verification code lets a criminal sign in, change the trusted details and lock you out.

The emails also feed other scams:

• Card theft. The fake "unlock" page asks for a card to "confirm your identity" or "restore purchases".
• Phone scams. Fake receipts give a number to call to cancel. The "Apple Support" agent then asks for a code or remote access. Apple says "If you get an unsolicited or suspicious phone call from someone claiming to be from Apple or Apple Support, just hang up." Our guide to callback phishing explains the pattern.
• Gift cards. Apple warns: "Never use Apple Gift Cards to make payments to other people." Any "Apple" request for gift card codes is a scam; see gift card scam emails.

The FTC lists the same tricks across all phishing: messages that "say they've noticed some suspicious activity or log-in attempts" or "claim there's a problem with your account or your payment information" (FTC).

What should I do if I clicked the link or entered my Apple password?

If you only opened the page and typed nothing, close it. If you entered a password, code or card, act now, in this order.

1. Change your Apple Account password from your device. On iPhone: Settings > your name > Sign-In & Security > Change Password. On the web: account.apple.com > Sign-In and Security > Password (Apple Support). If prompted, choose Remove Other Devices so other devices must sign in again.
2. If you can't sign in, start from iforgot.apple.com, typed by you, and follow Apple's recovery steps (Apple Support).
3. Check the devices on your account. In Settings, tap your name and scroll to the device list, or select Devices at account.apple.com. Apple says you can remove a device you don't recognize with Remove from Account, which signs it out remotely (Apple Support).
4. Call your bank if you entered a card, using the number on the card, and ask them to block it.
5. Change the same password everywhere else you used it, starting with email and work accounts.
6. Tell IT straight away if it's a work device or work address, and say whether you entered a code or approved a prompt.
7. Report it. Forward the email to reportphishing@apple.com. The FTC also takes reports at ReportFraud.ftc.gov.

The general checklist is in what to do after clicking a phishing link.

Why should a business care about Apple ID phishing?

Apple ID phishing looks personal, but it lands in work inboxes and on work phones.

• Work addresses get it. Scammers mail huge lists, and many people created their Apple Account with a work email.
• Company iPhones sync business data. Photos of whiteboards and documents, notes, contacts and backups can all sit in iCloud.
• Password reuse turns it into a work breach. If the Apple password matches a Microsoft 365 or Google Workspace password, the attacker tries it there next. See signs your email account is compromised.
• Company cards get typed into fake pages. Staff who pay for apps on a company card are the ones a fake "payment declined" email targets.

Our guide to mobile email security and BYOD covers the wider risk of personal accounts on work devices.

What should an admin do when fake Apple emails reach staff?

Treat it like any phishing campaign: block, clean up, then secure anyone who clicked.

1. Block the sender domain. In Microsoft 365, add it to the Tenant Allow/Block List; see how to block a sender or domain in Microsoft 365. In Google Workspace, use a blocked senders list or a content compliance rule.
2. Find and remove every copy. Search by subject and sender, then delete. Our guides cover removing a phishing email from all Microsoft 365 mailboxes and Google Workspace email log search.
3. Ask who clicked. Anyone who entered a password should change their Apple Account password and any work password that matches it. If a work password was reused, reset it and revoke sessions.
4. Remind staff of one rule: an Apple account problem is checked in Settings, never from an email. Add reportphishing@apple.com to your reporting instructions next to your own report button (how to report a phishing email).

Microsoft 365 and Google Workspace stop many of these emails, and for some small teams that's enough. When they keep arriving, an MX-level filter checks inbound mail for spam, phishing and spoofing before it reaches users, and holds suspect messages in a quarantine each person can review. iBlockSpam is priced per domain, not per mailbox; see pricing.

Next steps

1. Tell staff the rule: if an email says your Apple ID is locked, open Settings and tap your name. If it loads, the email is fake.
2. Make sure everyone uses a unique Apple Account password with two-factor authentication, and never reads a code to a caller.
3. Add reportphishing@apple.com to your internal phishing instructions.
4. Check your own domain's protection with the free Email Health Check, and if fake Apple emails keep reaching your team, see how iBlockSpam pricing works for per-domain filtering.

Browse our other phishing and threat guides.