Signs Someone Else Has Access to Your iCloud, and How to Cut Them Off

Signs someone has access to your iCloud, ranked

Apple’s own page on compromised accounts lists the signs to watch for. You get notifications about account activity you don’t recognise, or verification codes you didn’t request. There are messages you don’t recognise, devices you don’t recognise, and purchases you didn’t make. Those are strong. What is usually weak, despite how often it’s repeated online, is general phone behaviour: battery drain, heat, a slow camera. An iCloud sign-in on someone else’s device doesn’t make your phone behave any differently.

The most common real-world clue is simpler. Someone knows something they could only have seen in your photos, notes, messages or location. That is worth taking seriously, but it has several possible explanations. They may have iCloud access. They may be on a shared album, a shared note or location sharing you forgot about. Or they may have access to the phone itself. The checks below tell these apart.

Check the device list on your Apple Account

On your iPhone, open Settings, tap your name at the top, and scroll down to the list of devices. On a Mac it’s System Settings › your name. On the web, sign in at account.apple.com and open Devices. Apple notes that devices on this list can be used to change your password and receive verification codes. That’s why anything you don’t recognise is serious.

Look for more than strangers’ phones. An iPad a partner uses, an old iPhone you gave away, a Windows PC running iCloud for Windows: each one signed in with your Apple Account can see your synced photos, notes, and, depending on settings, your messages. Tap a device to see its model and serial number. When you’re ready, tap Remove from Account. Removing it is only half the job, though. If they know your password, they can sign in again, which is why the order later in this guide matters.

Apple also sends alerts by email, text or push notification when your account is used to sign in on a new device or your password is changed. A sign-in request you didn’t start means someone has your password. Tap Don’t Allow, and never read the code to anyone. Apple won’t ask for it by phone or message. If codes keep arriving unprompted, someone is trying repeatedly, and changing the password is urgent.

Check iCloud on the web

No device list shows every web session. Someone with your password and a code can open your mail, photos and notes at iCloud.com from any browser, and nothing new appears on your device list. There are two ways to deal with that. First, on iCloud.com, open your account menu, go to iCloud Settings and choose Sign Out Of All Browsers. Second, stop web access to your data altogether. On iOS 26.4 and later that’s Settings › your name › iCloud › iCloud.com, where you turn off Allow Data Access. Earlier versions call it Access iCloud Data on the Web. With it off, Apple says your data is available only on your trusted devices, though Find Devices still works on the web.

Sharing that’s working as designed

Not every leak is an intrusion. Location sharing in Find My shows your location continuously to anyone you shared it with, often years ago. Family Sharing gives the organiser visibility of purchases and, if location sharing is on, your whereabouts. A shared album or Shared Library shows everything added to it. A Mac or iPad signed in with your Apple Account receives your iMessages, and Text Message Forwarding can send your SMS to it too. Shared notes and shared password groups update for every member. Our guide to stopping someone from tracking your location goes through the location routes one by one.

Then there’s access through the phone itself. Apple’s personal safety checklist starts with changing your passcode. It also says to check Face ID for an unexpected alternate appearance, or Touch ID for a fingerprint you didn’t enrol. Anyone who knows your passcode can unlock the phone, read everything on it and, on an unprotected phone, change your Apple Account password from it. The same checklist also mentions reviewing unfamiliar apps and looking for an unknown device management (MDM) configuration profile.

Use Safety Check to remove access

On iOS 16 and later, Safety Check brings most of this into one place. Go to Settings › Privacy & Security › Safety Check. It needs two-factor authentication turned on. It offers two routes:

• Emergency Reset stops sharing with all people and apps at once. It then takes you through your Apple Account devices, the phone numbers used to verify your identity, emergency contacts and your password.
• Manage Sharing & Access goes person by person and app by app. It suits you if you want to keep sharing with family while removing one person, and it ends with a review of account security.

A Quick Exit button closes Settings instantly and keeps any changes you’ve already made. Apple is clear about the limits. Safety Check doesn’t manage non-Apple accounts or passwords, social media, devices signed in with a different Apple Account, or sharing turned on from an iPad or Mac. Apple also asks you to consider your safety before you make changes, because people may notice when sharing stops.

Cutting them off in the right order

Whether or not you use Safety Check, the order matters. An attacker who still controls a trusted number can approve a sign-in with your new password. And one who knows your passcode can change your password from your own phone.

1. Change your iPhone passcode (Settings › Face ID & Passcode), and reset Face ID if an unfamiliar appearance is set up.
2. Open Settings › your name › Sign-In & Security. Remove any trusted phone number or email address that isn’t yours. Apple’s advice is to check with your email provider and mobile carrier that you control every address and number on the account.
3. Change your Apple Account password. If you’re offered the option to sign out of other devices, take it.
4. Remove unknown devices from the device list, and sign out of all browsers on iCloud.com.
5. Run Safety Check to review sharing, apps with access and emergency contacts.
6. Harden the account. Consider security keys, which make a physical key required for new sign-ins, and turn on Stolen Device Protection.

What an iCloud check can’t show you

If the account checks come back clean and the leaks continue, the phone itself is the next place to look. Our guide on checking an iPhone for stalkerware covers configuration profiles, unfamiliar apps and signs of a jailbreak. Be aware that legitimate, visible monitoring apps are flagged by the same checks. Removing monitoring software can also alert whoever installed it, so the same safety planning applies.

How this page was put together

Paths and labels were checked in September 2026 against Apple Support’s pages on compromised Apple Accounts, checking and removing devices, managing web access to iCloud data, and the Apple Personal Safety User Guide chapters on Safety Check and on limiting device and account access. Apple renamed several settings in iOS 26. Where older versions differ, we’ve said so.

We didn’t test these steps on someone else’s account, and we don’t name any support helpline because numbers vary by country. Our editorial standards explain how these guides are researched and corrected.