Anyone Can Create an Apple ID with Your Email Address without Your Permission

Imagine waking up one day to 11 unread emails from Apple asking you to verify your Apple ID. Someone has just created an Apple ID with your email address on their new iPhone!

The first thing you might think is that someone has gained access to your email. You would then take steps to secure your account, such as changing your password, enabling two-factor authentication, and reviewing your activity logs.

You think that’s enough, but then you find dozens of other emails from someone trying to verify their Apple ID with your email address.

Isn’t it a bit annoying and concerning?

Following your intuition, you carefully read the email and follow the instructions. The instructions state that if you did not create the Apple ID, you can reset your password at iforgot.apple.com.

You might think that this will be straightforward and you can resolve this issue quickly. But you may be wrong about that assumption.

The website will greet you with a Reset Password button, followed by a short form where you can enter your Apple ID and type a text-based security code presented in graphic form.

After clicking the Continue button, you will be stuck on the next screen, where you are asked to confirm your phone number.

To your surprise, the phone number will be displayed in a hidden form, with only the last two digits visible.

To your annoyance, the phone number displayed is not yours, but the person who created the Apple ID with your email address.

Without knowing the phone number to enter at this stage, you will be stuck and unable to do anything else.

Try typing whatever you want, but you will end up with the following message.

This phone number is incorrect. Please enter a phone number that you use to receive verification codes for two-factor authentication.

At this stage, you realize that you are stuck and there is nothing you can do about it.

The initial thought would be to contact Apple for help. This should be straightforward, and they should be able to help you in no time.

Here is how wrong this assumption is!

Let’s contact Apple via chat.

You will be informed by chat support that this issue cannot be resolved through chat and needs to be escalated to a phone agent.

You may think that this is even better. You will have a human interaction with someone who can listen to your issues and concerns, and help you resolve them.

You may even describe how worried you are that someone is using your email and Apple ID to commit fraud, only to be surprised that your concerns are not taken seriously enough to be acted upon.

After spending some time on call, I learned that help with such an issue is very limited, or even not possible.

The only advice you will get is that you will not be able to create an Apple ID with your email address in the future, and you will need to use a different one.

But what if you don’t want to create a new email address right now? What if you don’t want to go through the hassle of opening another email account just to get your Apple ID working?

The simple answer is that you cannot do anything about it. This is what you will get from an Apple Support representative during a call.

According to Apple Support, it is possible that someone added your email address to their Apple ID by mistake because your email addresses are very similar. They may not realize that they have made a mistake, and they will continue to try to verify their email address without receiving any emails.

Apple Support will likely claim that they cannot do anything about this issue, as there is a chance that the person who used the wrong email address will eventually contact their support to get it sorted out. However, I believe that it is more likely that the person will simply give up and create a new Apple ID, leaving your email address locked in the Apple system and unusable.

This is quite absurd. As a long-term Apple user, I am quite annoyed by the lack of options and willingness to help with this issue.

In that case, anyone could do that and consequently lock you out of using your email address for Apple ID purposes, and you would just have to accept it.

Please note that your email address may be a simple method to use for iMessage without having to provide your phone number. Therefore, the inability to connect an e-mail address limits the possibility of using iMessage as you want.

I am surprised that Apple security features do not prevent this from happening, or that there is no grace period for email verification after which unverified emails (accounts) will be locked or removed, forcing the other person to take some action.

Apple theoretically removes unused Apple IDs from their system after 2 years. However, how do you know that this Apple ID is unused? Just because the other person can log in to their account, even if the email address is not verified, doesn’t mean that they cannot use it. This is nonsense!

The issue can become even more complicated if you create an Apple ID with a different email address. At some point, you might accidentally verify the Apple ID on an email address that was added by another person by mistake.

Assuming that this is not a fraud but a genuine mistake, the best-case scenario is that nothing will happen. However, we live in a dangerous world, and if someone can create an Apple ID with your email address and you cannot do anything about it, and Apple will not be able to help you, then there is something seriously wrong with the system.

I am usually a problem solver, but this experience has really disappointed me, Apple.

An update - 10 days later

This whole situation annoys me. The approach from Apple Support was very disappointing and I couldn’t believe that’s it, that nothing could be done.

Days passed and my friend who was affected by this nonsense kept telling me that he still receives plenty of emails every single day from Apple asking him to verify his email address.

These emails originate from the other person’s end, who is continuously, every single day, trying to verify his email address not noticing that is probably the wrong one (mistyped or misspelt).

If you are flooded with hundreds of emails from a company that puts privacy on top of the list, you will say enough and will try to sort out this issue.

Armed with an argument that Apple was spamming my friend’s emails, we contacted Apple Support once again. This time the conversation was very different. It was still polite but with a piece of blame onto Apple so they would understand the irritation that this whole situation was causing.

From Apple Support chat we have been transferred to Phone Support where, going once again through things we tried to get this sorted once and for all.

During the first contact with Apple we received a case number and we stuck with this case number till the end. Thanks to that we have a whole history.

As much as the person on the other end of the line tried to do whatever the other person days before tried as well, he hadn’t seen an option for what else could be done, but there was one difference. He fully understands the situation of being spammed by Apple email asking to verify email addresses. He knew that if this happened to him, he would be annoyed same as my friend was.

Thanks to that he decided to go a step further in the hierarchy of Apple Support and reach his supervisor (or the person with more knowledge and power).

This was a brave move showing that there is a chance to get this thing sorted, and it was.

After going through some details the other support person suggested that one method to get this sorted, which on initial call was never considered.

Going through details we advised on which device the person created Apple ID, from which country it originated (as some Apple emails have been sent in a foreign language before changing to English), and the whole timescale when exactly happens. Good that my friend didn’t remove all these emails.

Apple Support at the higher end got the power to verify the ownership of the email attached to the Apple ID.

By invoking this action, Apple will request from us a verification code that will be sent to our email.

The email with the subject “Email Ownership Verification Code” will state:

“Dear Customer, Provide the following verification code to your AppleCare advisor.”

Thanks to that Apple initiated the removal of the email address originally connected to the Apple ID created by another person.

They don’t have the power to remove Apple ID altogether, and I would not persist in doing this, as the other person may be genuine.

Once email is removed from Apple ID, the other person still is able to log into their Apple ID using their phone number. At the time when they do, they will likely be asked to put their new email address. Alternatively, they will be pushed towards contacting Apple Support to discuss this matter.

Deattachment of the email address does not happen straight away. As advised this may take a couple of days and it did.

From the end of the call, my friend hasn’t been bothered by Apple emails anymore and 2 days later, when checked on iforgot.apple.com, his email was no longer recognised as an Apple ID.

Here is a success to the whole story.

I am happy that this issue has been sorted. This restores my optimism in Apple Support which was initially put into doubt.