A few weeks ago now I received an email that someone (not me) had made some in-game purchases on an iTunes account. I logged into my iTunes account and saw the transactions and that my account was some how joined to a family group account. Upon further investigation, the transactions were made using a different credit card that wasn't mine as they never showed up on my credit card statement (and the last 4 digits weren't mine). After an hour on the phone with Apple, I was able to get my account detached from the family group.

According to the Apple support, a child would need to accept an invitation to join a family group. I received no invite so the attacker was somehow able to circumvent that.

The account it was linked to seemed to be fake. The contact information was somewhat random. The name was sger erhs and address was rewahgewr. The province and city and postal code was where I live (although the postal code was not exactly the same as mine). After talking to a friend, I found out the in-game purchases were for a game that can only be played in China so that is probably where the attacker lives.

Since no purchases were made using my credit card and they didn't gain direct access to my account, what was the attackers intent here? Did the attacker get anything out of this? Besides changing my password, is there something else I be doing to be secure?

  • 1
    Would putting your account in their group circumvent region locks on content? E.g., if your account is in the US and theirs is in China, would having your account in their group allow them to buy content that is unavailable in China but available in the US? May 1, 2018 at 20:27

2 Answers 2


This is a really strange one, never seen such a thing happen myself. It's hard to say what his intentions would've been, one thing that springs to mind is if the card he used was stolen (fraud) I guess by joining it to "group" he could make it appear that he didn't do it? It's a longshot of an answer I'm afraid but that is literally the only thing that comes to my head.

In terms of did he get anything - IF he was doing it for the reason I suggested I guess the actions could potentially come back to you, but as I said it's a bit of a longshot.

I don't think there is much else you can do other than changing your password and he didn't get access to the account anyway so it seems he really didn't achieve anything.

I'd be interested to know how he could circumvent the acceptation that's interesting I've no idea how though unfortunately.

Hope this answer helps... I would've put it in a comment but I can't.


what was the attackers intent here?

The individual in question needed your account to access the data in question. It is difficult to create an iCloud account in many geological places. They needed to access an Apple service, and the individual made no attempt to acquire your finances. Furthermore, downloads are restricted per-country.

You can enable Two Factor Authentication to control access to your account; although I just recently lost quite a few purchases after my phone number changed.

Two-factor authentication for Apple ID

The second thing you can do is reduce what's named the "Attack Surface" of machines with access to your account. In laymen's terms, the attack surface is the sum of software potentially with vulnerabilities. Beware of third-party apps and plugins. Choose software carefully.

Attack surface

Lastly, be very careful with any popup dialogue; specifically dialogues regarding your keychain.

Frequently asked questions about iCloud Keychain

  • Could you perhaps give an example of a country where it is difficult to create an account? I'm not aware of such an issue.
    – user173641
    May 4, 2018 at 8:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .