"Your Apple ID has been locked": check the message without losing your account.

The message might claim Apple detected suspicious activity on your account, or that iCloud will be disabled unless you verify it right away — with your photos and backups dangled as what's at risk. Apple has shifted much of its documentation toward the term "Apple Account," but plenty of scam campaigns still say "Apple ID," so the label alone tells you nothing about whether the message is real. Verification should only ever happen through your device's Settings app, another trusted Apple device, or by manually typing account.apple.com into a browser — never through the button in the email or text itself.

This scam works partly because most people genuinely don't know what a real Apple security notice looks like, since they rarely see one. That unfamiliarity makes almost any alarming message about the account feel plausible enough to click through, especially when it threatens something as personal and hard to replace as years of photos.

What the fake page is actually after

The first thing a fake Apple page collects is your account and password. If that works, it typically goes further and asks for a two-factor code, a phone number, card details, security question answers, an ID document, or even your device passcode. That combination matters: a password plus a live two-factor code can be enough for an attacker to add their own device to the account or change its recovery settings, which is a much bigger problem than a stolen password alone.

Warning signs

• A threat to erase your photos or lock the account within just a few hours
• A link that opens an unfamiliar domain, or one using lookalike characters with "secure," "verify," or "icloud" tacked onto an unrelated domain
• An unsolicited phone call claiming to be Apple support
• A browser pop-up displaying a phone number to call
• Anyone asking you to read a verification code out loud over the phone

The urgency itself is often the biggest tell. Apple's real account notifications generally give you time to review and respond through the device you're already using, rather than demanding an action within a countdown before anything can be checked properly.

Apple's own guidance is not to respond to suspicious calls or messages and to contact the company only through official channels if you're unsure.

Pop-ups and pages that mimic system alerts deserve particular caution, since a browser window can be styled to look almost identical to a real operating-system dialog. If a "security warning" appears while you're simply browsing the web, treat it the same way as an email: close it, don't call any number it displays, and check the account status independently instead.

How to check your account yourself

On a device you already trust, review your connected devices, trusted phone numbers and email addresses, recent sign-in alerts, password changes, any codes you didn't request, and recent purchases. You can also type account.apple.com into a browser manually to check the account directly. If your password no longer works, use iforgot.apple.com to start recovery through Apple's official process rather than anything linked from a suspicious message. This same review is worth doing periodically even without a prompting message, simply as routine account hygiene.

If you already shared your password or a code

Change the password immediately. Remove any devices you don't recognize from the account. Review your recovery phone numbers and email addresses and confirm you still control every one of them. If you entered payment information anywhere in the process, contact your card issuer as well. Apple provides a phishing reporting address, reportphishing@apple.com, for forwarding suspicious emails. Doing this quickly matters more than doing it perfectly — a password change within minutes closes off far more risk than a delayed, thorough cleanup done a day later.

Reducing the risk going forward

Turn on two-factor authentication if it isn't already active, use a strong device passcode, keep your recovery information current, and consider setting an account recovery contact. It's worth remembering that a security alert doesn't automatically mean your account has already been compromised — it could be phishing, or it could be a real attempt that Apple already blocked on its own. Either way, the safe response is the same: verify through an official channel before doing anything else. It's also worth backing up your photos to a second location periodically, independent of iCloud itself, so that even in a worst-case scenario the threat of losing them entirely carries less weight over your decisions.

Quick checklist

• Never verify your Apple ID through a link in an email or text
• Check account status directly in Settings or at account.apple.com
• Never share a two-factor code with anyone, including someone claiming to be Apple
• Use iforgot.apple.com if your password stops working
• Report suspicious messages to reportphishing@apple.com