iCloud Hacked and iPhone Locked With Find My: What to Do

Your iPhone suddenly shows a lock screen you did not set, with a message asking you to contact someone or pay. Or your Mac restarts into a screen asking for a passcode you never created. Somebody has signed in to your iCloud and used Find My against you.

The short answer: this is an Apple Account takeover, and the fix starts with the account, not the device. Take the password back, remove the attacker's devices, and the locks lose their grip. Your iPhone passcode often still works, and an erased device stays tied to your account.

This guide covers what each lock means, how to take the account back, how to unlock each device, and the scams that follow this kind of hack.

Last checked: 5 October 2026.

#What Should You Do If a Hacker Locked Your iPhone With Find My?

Reset your Apple Account password straight away. Apple's page on a compromised Apple Account lists "Your device was locked or placed in Lost Mode by someone other than you" as a sign of compromise. Change the password on a trusted device if you still have one, or reset it at iforgot.apple.com. Then sign in at account.apple.com, remove devices you do not recognise and correct any details the attacker changed. If you cannot reset the password, start account recovery and wait for Apple. Do not pay the person behind the message, and do not reply to them.

#Locked, Lost Mode or Erased: What Did the Attacker Do?

Find My gives anyone signed in to your Apple Account three remote actions: mark a device as lost, lock a Mac, or erase a device. Each leaves a different screen and needs a different fix. The labels below come from Apple's iCloud guides at the time of writing; exact wording can vary by device, software version and region.

Apple's Lost Mode guide says a confirmation email goes to the Apple Account email address whenever Lost Mode is turned on. If you never received one, the attacker may already have changed that address, which tells you to go straight to a password reset.

#Take the Apple Account Back First

Every lock depends on the Apple Account. Until you control it again, the attacker can lock or erase the same device a second time. Apple's compromised account page gives this order:

1. Change your Apple Account password, using a strong password you have never used elsewhere.
2. If the attacker already changed it, reset it. Apple's page on resetting a forgotten password says the easiest route is a trusted device signed in to your account with a passcode set: Settings, your name, "Sign-In & Security", then "Change Password".
3. No trusted device? Use the Apple Support app on a family member's iPhone ("Reset Password", then "Help Someone Else"), a device at an Apple Store, or iforgot.apple.com.
4. Sign in at account.apple.com and correct any email address, phone number or security detail you do not recognise.
5. Under Devices, remove every device you do not recognise.
6. Check with your email provider and your mobile carrier that you control every email address and phone number on the account. Apple specifically suggests asking the carrier whether SMS forwarding was set up.

If the phone asks you to wait an hour before changing the password, that is Stolen Device Protection, which Apple says may require a security delay. Let it run rather than turning it off.

#When You Cannot Reset the Password: Account Recovery

If the attacker changed the password, the trusted phone number and the email, a normal reset may fail. Apple's compromised account page says to go to iforgot.apple.com and start account recovery, then regain access after a waiting period.

1. Start recovery from Settings on a device where you try to sign in, or from "Reset Password" at iforgot.apple.com.
2. Turn off every other device signed in with your Apple Account. Apple's account recovery page says recovery is cancelled automatically if the account is in use during the request.
3. Watch for Apple's confirmation email, which gives the date and time you can expect to regain access.
4. When the wait ends, Apple sends a text or automated call. If none arrives, return to iforgot.apple.com after the date in the email.

If you still know your password but lost the phone that receives codes, the route is different. Our guide to losing your trusted device or number for Apple two-factor covers that case. If the Apple Account itself shows a lock message, see what each Apple Account lock message means.

#Unlocking an iPhone or iPad the Attacker Put in Lost Mode

This is often the easiest part. Apple's Lost Mode guide says that if an iPhone or iPad already has a passcode, that passcode is what unlocks it. The person who marked it as lost only chooses a passcode when the device had none.

• Enter your usual passcode on the device. Apple says this also turns off Lost Mode. With Stolen Device Protection on, you may need Face ID or Touch ID as well.
• Once you control the Apple Account, you can also go to icloud.com/find, select the device, select "Lost", then "Stop Lost Mode".
• Apple Pay cards and transit cards suspended by Lost Mode can be used again after you turn it off and sign back in to your Apple Account.

If the device never had a passcode, the attacker's code locks it. In that case take back the account first, then stop Lost Mode from icloud.com/find.

#Unlocking a Mac Locked Through Find My

Macs work differently, and Apple's guide carries a warning: you cannot unlock a Mac online or on another device, only on the Mac itself.

• Intel Mac: the person who locked it had to create a numeric passcode. After you regain your Apple Account, go to icloud.com/find, select the Mac, select "Unlock", confirm with your Apple Account password, and enter the passcode it gives you on the Mac.
• Mac with Apple silicon: Apple says it is locked with the Apple Account password, so you unlock it on the Mac with your Apple Account email or phone number and your current password, which means the one you set after taking the account back.

Either way, there is no shortcut that skips the Apple Account. That is the point of the design, and it is why the account reset matters more than anything you try on the device.

#If the Device Was Erased: Activation Lock Still Protects It

An erase removes your data from the device, but not your claim on it. Apple's erase guide says Activation Lock remains on after a remote erase, and your Apple Account and password are needed to reactivate the device. Apple's Activation Lock page adds that devices on iOS or iPadOS 15 or later show an "iPhone Locked to Owner" screen.

1. If the device is offline and has not been erased yet, Apple says you can select "Stop Erase Request" at icloud.com/find and enter your Apple Account password.
2. If it was already erased, take back the Apple Account, then follow the setup screens and sign in with the Apple Account and password you control. Apple's page on removing Activation Lock also accepts the device passcode on that screen.
3. Restore your data from an iCloud or computer backup only after the account is secure.
4. If you cannot regain the account at all, Apple offers an Activation Lock support request for people with proof of purchase. Find the receipt or invoice from the Malaysian shop or carrier that sold you the device.

Apple also says a Lost Mode message keeps displaying after an erase, so an attacker's message can stay on screen until you sign in.

#Ransom Notes and "Your iPhone Was Found" Messages

Lost Mode lets whoever turns it on put a message and phone number on the Lock Screen. An attacker can use that space to demand money, in English, Bahasa Malaysia, Chinese or any other language, and to push you into contacting them. Do not. Paying does not return the account, and replying gives them a live target.

A second scam can follow: an SMS or email saying your lost iPhone has been found, with a link to "view its location". It may be written in Bahasa Malaysia, for example "iPhone anda telah dijumpai", or in Chinese. Apple warns that scammers typically send people to a fake website that looks like a real Apple sign-in page, built to capture the password and code you just reset.

Apple's page on social engineering and phishing says Apple will never ask you to log in to any website, tap "Accept" on a two-factor prompt, or give your password, device passcode or verification code. It also says Apple never asks you to turn off a security feature, and warns never to use Apple Gift Cards to pay other people.

• Screenshot any suspicious SMS that claims to be from Apple and email it to [email protected], as Apple's page describes.
• Hang up on calls from "Apple" about your locked phone. Apple says caller ID can be spoofed.
• If you typed your password into a fake page, change it again at once on a trusted device.

If you clicked a link and are unsure what you gave away, our checklist for what to do after clicking a phishing link goes through it step by step.

#Evidence Checklist While You Wait

• Photos of each locked screen, showing the message and any phone number on it.
• Every Apple email about Lost Mode, an erase, a password change or account recovery, with dates.
• Your Apple Account email or phone number, and every other address or number you may have used.
• Serial numbers or IMEI numbers from the box or the receipt, and the proof of purchase itself.
• The suspicious SMS, emails or calls that came before or after, with sender details visible.
• A short timeline: when you last used the device normally and when the lock appeared.

#Mistakes That Make an iCloud Hack Worse

• Calling or messaging the number on the lock screen.
• Paying any amount, in money, crypto or gift cards, to have the device unlocked.
• Leaving an old iPad or Mac switched on during account recovery, which can cancel it.
• Restarting recovery because the wait feels long.
• Skipping the email and SIM check, so the attacker can reset the password again.
• Handing the device to an "iCloud unlock" shop that asks for your codes.

#If You Paid or Shared a Code in Malaysia

Deal with money first. The government's NSRC 997 page says to call 997 within 24 hours of discovering a scam, contact your bank, and make a police report at the nearest station. Apple's compromised account page also lists purchase activity you do not recognise as a warning sign, so check your card and App Store purchases.

If your phone shows "No service" while Apple codes stop arriving, call your carrier from another phone and ask whether your SIM was replaced or forwarding was added; our guide to SIM swap attacks in Malaysia explains what to ask. Phishing sites and hacked accounts can be reported to CyberSecurity Malaysia's Cyber999 by online form, email, phone or its mobile app.

#Locking the Account Down Afterwards

• Keep two-factor authentication on. Apple says Security Keys add protection against targeted phishing.
• Turn on Stolen Device Protection on your iPhone.
• On each device, check which Apple Account is signed in, including FaceTime, Messages and Media & Purchases.
• Visit account.apple.com now and then to review your trusted numbers and devices.

#When a Case Review Makes Sense

Most people work through this alone: take the account back, unlock each device, and keep the receipts. A second opinion helps when the same Apple Account also holds logins for a business, when several family devices were locked at once, or when recovery keeps getting cancelled. SocialSafe by AwareXone, our recovery service, reviews the case first and tells you honestly which Apple route is still open. Only Apple can return an Apple Account or remove Activation Lock, and some requests are denied. Our account security service explains how we help, and our Trust Center lists what we will never ask for, starting with your password and codes.

#Frequently Asked Questions