Apple threat notification: how to tell if it’s real and what to do
An Apple threat notification is real only if Apple also shows it at the top of your account page after you sign in at account.apple.com yourself. Genuine alerts appear on the iPhone Lock Screen and in Settings, and arrive by email from threat-notifications@email.apple.com. They never ask you to tap a link, install anything or share a password or code.
A new wave of these alerts started on October 29, 2026, and on November 2 Germany’s digital minister confirmed that members of the Bundestag and the federal government were among the recipients. Below: how to check an alert in two minutes, what to do in the first hour if it is genuine, what Lockdown Mode changes on your phone, and how to spot the fake versions that scammers send after news like this.
Before you start
- Who gets these: people Apple believes were individually targeted by mercenary spyware, usually journalists, activists, politicians and diplomats
- Real sender: threat-notifications@email.apple.com, plus an alert on the iPhone itself
- How to verify: sign in at account.apple.com by typing the address yourself, not from a link
- What you need: your Apple Account password, a second device or a computer if you suspect the phone itself
What happened this week
Apple sends threat notifications several times a year. Its support page says it has notified users in more than 150 countries since 2021 and that it does not attribute attacks to any specific attacker or region.
The latest round began reaching phones on October 29, 2026. TechAeris reported the new wave on October 30, and on Sunday, November 1, German digital minister Karsten Wildberger said on ARD that Apple had warned that “certain devices may have been compromised with so-called spyware”. According to Euronews, Germany’s Federal Office for Information Security (BSI) wrote to everyone affected and advised them to assume, as a precaution, that their device may be compromised, because the alert does not say whether an attack succeeded.
Neither Apple nor the German government has said who is behind the attacks or how many people received alerts. Apple has not commented publicly on this wave.
How to check if an Apple threat notification is real
Apple’s own guidance is short: the alert is genuine only if it also appears on your account page. Do this from a device and browser you trust.
- Do not tap anything in the email or message. Close it.
- Open a browser and type account.apple.com into the address bar yourself.
- Sign in with your Apple Account.
- Look at the very top of the page. If Apple sent you a threat notification, a banner is shown there.
- On your iPhone, open Settings. A genuine alert also appears there and on the Lock Screen.
If there is no banner on account.apple.com, treat the message as a phishing attempt and delete it. If the email asked you to call a number, open an attachment, install a profile or confirm your password, it is fake no matter what the sender line says. Apple states that its threat notifications “never ask the user to click any links, open files, install apps or profiles” or provide an Apple Account password or verification code.
| Sign | Genuine Apple alert | Likely scam |
|---|---|---|
| Sender | threat-notifications@email.apple.com | Lookalike domains, Gmail or random addresses |
| On the iPhone | Alert on Lock Screen and in Settings | Text message or WhatsApp only |
| account.apple.com | Banner at the top after sign-in | Nothing shown |
| What it asks | Read guidance, consider Lockdown Mode, get expert help | Click a link, call support, install an app or profile, send a code |
| Money | Never | “Security fee”, gift cards, crypto |
What to do if the alert is genuine
Apple cannot tell you what triggered the alert, and outside helpers do not get that information either. The steps below follow Apple’s guidance and the BSI’s advice to treat the phone as possibly compromised.
1. Get expert help first
Apple recommends the free Digital Security Helpline run by the nonprofit Access Now, which answers 24 hours a day, seven days a week. Contact them from a different device if you can. Work or government users should also tell their IT security team before changing anything, because they may want to examine the phone.
2. Update the phone
Open Settings > General > Software Update and install everything available. Apple’s guidance for all users starts with running the latest software, which carries the newest security fixes.
3. Turn on Lockdown Mode
On iPhone or iPad: open Settings, tap Privacy & Security, scroll down and tap Lockdown Mode, tap Turn On Lockdown Mode, then Turn On & Restart and enter your passcode. On a Mac: Apple menu > System Settings > Privacy & Security > Lockdown Mode > Turn On, then Turn On & Restart.
Lockdown Mode has to be turned on separately on each iPhone, iPad and Mac. A paired Apple Watch follows the iPhone automatically.
4. Move sensitive conversations
Until an expert has looked at the device, assume messages, calls, contacts, calendar and location on it could be visible to an attacker. The BSI warned recipients that spyware of this kind can reach encrypted chat apps and switch on the microphone and camera. Have sensitive conversations in person or on a separate, clean device.
5. Secure the account from a clean device
Change your Apple Account password from a computer you trust and review signed-in devices at account.apple.com. Do the same for your main email account. Our guide to turning on two-step verification for Google and Microsoft covers the other accounts most people should lock down next.
What Lockdown Mode changes
Lockdown Mode is built for the small number of people who may be personally targeted, and your phone will feel different with it on. According to Apple’s Lockdown Mode page:
- Messages: most attachment types are blocked except certain images, video and audio; links and link previews are unavailable.
- Safari: some complex web technologies are blocked, so some sites load slowly or break.
- FaceTime: calls from people you haven’t called in the past 30 days are blocked.
- Photos: location is stripped from shared photos and shared albums are removed.
- Connections: the device must be unlocked to connect to accessories or a computer; 2G and 3G are switched off.
- Profiles: configuration profiles can’t be installed and the device can’t be enrolled in MDM.
Phone calls, plain text messages and emergency SOS still work. You can exclude a trusted website or app under Settings > Privacy & Security > Lockdown Mode > Customize Web Sites, and on iOS 27 or later you can exclude specific contacts from message limits under Customize Contacts. Every exclusion weakens the protection, so keep the list short.
Watch for fake threat notification scams
News about spyware alerts gives scammers a ready-made script. Expect emails and texts that copy the wording, then push you to “verify” your account, call a support line or install a “security profile”. The account.apple.com check above defeats all of them. If you already entered your password on a page you reached from a link, change it immediately and check whether your email address appears in known data breaches. The same habits that stop fake calendar invite scams apply here: never act on a link inside an unexpected security warning.
What we could not verify
- How many people received the October 29 alerts, or in which countries. Some reports cite 99 countries from the notice text; Apple has not confirmed a number.
- Which spyware was used or who deployed it. Apple does not attribute attacks, and German officials have not named a suspect.
- Whether any targeted phone was actually infected. The alert only says an attack was detected.
We checked Apple’s threat notification and Lockdown Mode support pages and the Euronews report on November 2, 2026.
FAQ
Will most people ever get an Apple threat notification?
No. Apple says the vast majority of users will never be targeted by this kind of attack, which costs millions of dollars and is aimed at a very small number of people.
Can I turn on Lockdown Mode without getting an alert?
Yes. Apple says anyone with good reason to believe they may be individually targeted can enable it. It is available on iOS 16, iPadOS 16, watchOS 10, macOS Ventura and later.
Does a factory reset remove mercenary spyware?
Apple does not say. Some spyware does not survive a restart, but a reset can also destroy evidence an investigator needs. Talk to the Access Now helpline or your security team before wiping the phone.
I got the alert by text message only. Is it real?
Apple’s delivery methods are the iPhone alert, email and the account.apple.com banner. A text message alone is not one of them, so check account.apple.com before doing anything else.
Next step
If you received an alert, sign in at account.apple.com from a trusted device to confirm it, then contact Access Now’s helpline before changing anything else. If you didn’t, install the latest iOS update today and make sure two-factor authentication is on for your Apple Account.
Related guides
- Fake package delivery text? How to check it and report it
- iOS 27.2 is out: what’s new, what’s missing and should you update
- iPhone SynthID watermark: how to check if a photo was AI-edited
Sources
- Apple Support: About Apple threat notifications and protecting against mercenary spyware (checked November 2, 2026)
- Apple Support: About Lockdown Mode (checked November 2, 2026)
- Euronews: German MPs and ministers warned iPhones have been targeted by spyware (November 2, 2026)
- TechAeris: Apple sends new threat notifications (October 30, 2026)
