Family members recently reported to me that they got a popup message on their iPhones and Macs asking them to re-enter their Apple ID password for the account associated with iCloud. I’ve seen with my own eyes and I have no idea how widespread this is, but it was peculiar to see it so close to home (literally).
Fortunately, I have spread skepticism about entering one’s password into a random popup and both my wife and father asked me if these requests were legitimate. These may say “Apple ID Verification,” and they appear over the Home screen in iOS/iPadOS, and as a system popup window in macOS.
You can imagine that malware that could create something similar would be an effective—if short lived–way to phish for people’s passwords. In fact, a researcher managed to find a bug in 2015 (quickly patched) that allowed a specially crafted email message
to display a very suspiciously accurate dialog.
In the cases I’ve seen, however, it’s entirely legitimate, if the reason for the confirmation is mysterious. You can avoid doubt, however. Here’s how to check.
Click or tap Cancel or Not Now, depending on the dialog.
Go to Settings > account name in iOS or iPadOS, the iCloud preference pane in Mojave or earlier, or the Apple ID preference pane’s iCloud view in Catalina or later.
Varying by system and version, an alert, a prompt, or a button should appear that indicates there’s a problem with your login and asks you to re-enter the password. Enter your password.
If you don’t see an item as in Step 3 above, it’s plausible it’s some kind of phishing attempt, but it’s more likely given known threats and the way they present themselves right now that it was a transient problem on Apple’s end.
Ask Mac 911
We’ve compiled a list of the questions we get asked most frequently along with answers and links to columns:
read our super FAQ to see if your question is covered. If not, we’re always looking for new problems to solve! Email yours to
firstname.lastname@example.org including screen captures as appropriate, and whether you want your full name used. Not every question will be answered, we don’t reply to email, and we cannot provide direct troubleshooting advice.