iPhone Hacked Notification on Safari? It’s a Scam

Last updated: November 4, 2026

Last checked against Apple’s Recognize and avoid social engineering schemes and Block pop-up ads and windows in Safari pages on November 4, 2026, for Safari on iOS 27.2 (the latest version in Apple’s iOS 27 release notes).

Seeing an iPhone hacked notification on Safari, such as “Your iPhone has been hacked” or “Virus detected! Act now”? It’s a scam. A website can’t scan your iPhone, and Safari doesn’t show hacking warnings like that. Apple says pop-ups that warn about security problems or viruses on your device are “usually fraudulent advertisements, designed to trick you into downloading damaging software or giving the scammer personal information or money.” The warning itself can’t harm your iPhone. The danger comes from tapping its buttons, calling its number or typing in your details.

Quick answer: Don’t tap anything inside the pop-up, don’t call any number it shows and don’t install anything it offers. Close the tab: tap the Tabs button, then the close button on that tab. Then go to Settings > Apps > Safari, tap Clear History and Website Data, and make sure Block Pop-ups and Fraudulent Website Warning are on. If the “hacked” alerts appear in your Calendar, delete the spam calendar. Only change your Apple Account password if you typed it into the page. You don’t need an antivirus app.

Why the “iPhone Hacked” Pop-Up Is Fake

These warnings usually appear on a website you didn’t mean to visit, often after tapping an ad, a misspelled web address or a link in a message. They’re designed to scare you into acting fast. Common versions say things like:

• “Your iPhone has been hacked” or “Your iPhone is infected with viruses”
• “Apple Security Alert: call this number now”
• “Install this app or VPN to protect your iPhone”

Here’s how to tell it’s not real:

• It appears inside Safari, on a webpage. A webpage has no way to check your iPhone for hacking or viruses.
• It pressures you. Countdown timers, alarms, vibrating text and “act now” language are classic scam tactics. Apple says scammers create “a strong sense of urgency” so you don’t have time to think.
• It shows a phone number or a download button. Apple says to ignore these warnings and not call the number or follow the links.
• It uses Apple’s logo. Scam pop-ups often copy Apple’s branding. Apple’s Safari pop-up page warns that some third-party ads “use phishing tactics such as warnings or prizes to trick you into believing they’re from Apple”.

How to Get Rid of the Fake Hacked Warning in Safari

1. Close the Tab Without Tapping the Pop-Up

Some scam pop-ups have fake close buttons that open another page, so Apple says to be careful and, if you’re not sure, avoid interacting with it and close the window or tab instead.

1. In Safari, tap the Tabs button (two overlapping squares).
2. Find the scam page in the tab overview and tap the close button (✕) in the upper-right corner of that tab.
3. If a message box blocks the screen and won’t let you reach the Tabs button, tap the top of the screen to show the Search field and type a different web address. Apple suggests this for pop-ups that seem to take over your screen.

If the same page reopens every time you launch Safari, go straight to the next step.

2. Clear Safari History and Website Data

This removes the scam site’s cookies and cached data, so it can’t reload by itself.

1. Open the Settings app, tap Apps, then tap Safari.
2. Scroll down and tap Clear History and Website Data.
3. Choose the timeframe (for example, the last day or all history), then tap Clear History.

Apple says this doesn’t change your AutoFill information. You may need to sign in to some websites again afterwards. If the button is grey, there’s either nothing to clear or web content restrictions are set in Screen Time.

3. Turn On Block Pop-ups and Fraudulent Website Warning

1. Go to Settings > Apps > Safari.
2. Turn on Block Pop-ups.
3. Turn on Fraudulent Website Warning, so Safari warns you before opening known scam sites.

These won’t stop every scam ad inside a normal webpage, but they block new pop-up windows and flag known fraudulent sites.

4. Update iOS

Go to Settings > General > Software Update and install the latest version of iOS 27. Apple says many updates include security improvements, including ones that help control pop-ups.

5. Check Your Home Screen for Web Apps With Notifications

If the fake warnings now arrive as notifications on your Lock Screen, not just inside Safari, check whether a scam site was added to your Home Screen as a web app. On iPhone, a website can only send notifications if it has been added to the Home Screen and you allowed notifications.

1. Look for an unfamiliar icon on your Home Screen and in the App Library. Delete any web app you don’t recognise: touch and hold its icon, then choose the option to remove or delete it.
2. Go to Settings > Notifications, tap any name you don’t recognise and turn off Allow Notifications.

“iPhone Hacked” Notification in Calendar? Delete the Spam Calendar

If the “Your iPhone is hacked” alerts appear as Calendar events, with alarms going off every hour, you’ve probably subscribed to a spam calendar by tapping a button on a website. Apple lists unwanted Calendar invitations and subscriptions among common scam tactics. Deleting the calendar stops the alerts.

1. Open the Calendar app and tap the Calendars button.
2. Find the calendar you don’t recognise (often under a “Subscribed” heading). Tap the info button (ⓘ) next to it.
3. Tap Delete Calendar or Unsubscribe, then tap it again to confirm.

For a single spam event from an unknown sender, tap the event, then tap Report Junk and Delete and Report Junk, or tap Delete Event. Apple’s delete calendars and events page has these steps for iOS 26 and later. Don’t tap links inside the spam events.

Check for Configuration Profiles You Didn’t Install

Some scam pages try to get you to install a “security profile” or VPN profile. Apple warns that apps and downloads that ask to install configuration profiles can then control your device. Check that nothing was installed:

1. Go to Settings > General > VPN & Device Management.
2. If you see a profile you don’t recognise and didn’t install for work or school, tap it, then tap Remove Profile and enter your passcode.
3. Restart your iPhone.

Apple says deleting a profile also deletes the settings, apps and data that came with it. If the iPhone belongs to your employer or school, ask them before removing anything.

Already Tapped the Pop-Up? What to Do Next

Just seeing the page or closing it is fine. What matters is what you did on it:

• You typed your Apple Account password into the page: change it right away from Settings > [your name] > Sign-In & Security > Change Password, and make sure two-factor authentication is on. Apple’s advice for anyone who “might have entered your password or other personal information on a scam website” is to change the password immediately. If you use the same password anywhere else, change it there too. Our guide on how to check if your password was leaked shows how to find reused passwords in the Passwords app.
• You entered card or bank details: contact your bank or card provider using the number on your card or their official app, and tell them it was a scam site.
• You called the number: hang up if you’re still on the call. Don’t give the caller codes, passwords or payment, and don’t follow instructions to share your screen or install anything. If you already gave them a password or a code, change that password and check your account as described below. Apple says it will never ask you to provide your password, passcode or two-factor authentication code, or to turn off security features such as two-factor authentication or Stolen Device Protection.
• You installed an app it suggested: delete the app, and check for a configuration profile as above. Install apps only from the App Store.
• You paid for a “fix” or gift cards: contact your bank or card provider. In the US, Apple points people to the FTC at reportfraud.ftc.gov. Elsewhere, report it to your local police or national fraud reporting service.

Beware of “recovery” scams. After a scam, people often get messages or comments from “hackers”, “recovery experts” or “Apple agents” who offer to get money back or remove the hack for a fee. These are scams too. Nobody can legitimately “hack back” your money or your account. If you need help from Apple, start from Apple’s official Apple Support site yourself, never from someone who contacted you first.

Real Signs Your Apple Account Has Been Compromised

A pop-up isn’t one of them. Apple’s page If you think your Apple Account has been compromised lists the real warning signs:

• Apple notifies you, by notification or email, about account activity you don’t recognise, such as a sign-in on an unknown device or a password change you didn’t make
• You receive a two-factor authentication code you didn’t request
• You notice messages you didn’t send, items deleted that you didn’t delete, account details or trusted devices you don’t recognise, or purchases you didn’t make
• Your password no longer works
• Your device was locked or put in Lost Mode by someone else

If any of these apply, follow Apple’s steps on that page: change your password, check your details at account.apple.com, remove devices you don’t recognise and make sure you control every email address and phone number on the account. If you can’t sign in or reset your password, start account recovery at iforgot.apple.com, Apple’s official recovery site. Apple says recovery can involve a waiting period, so be wary of anyone claiming they can skip it.

What about Apple threat notifications?

Apple does send genuine threat notifications, but only to a very small number of people it believes were individually targeted by mercenary spyware. Apple says the vast majority of users will never receive one. A real one appears on the iPhone Lock Screen and in Settings, by email from threat-notifications@email.apple.com and as a banner at the top of account.apple.com after you sign in. Apple says they never ask you to click links, open files, install apps or profiles, or give a password or verification code. A warning inside a Safari webpage is never one of these.

Common myths

• “My iPhone is hot, so it must be hacked.” Heat on its own isn’t proof of hacking. iPhones get warm after updates, while charging and with demanding apps. See our guide on an iPhone hot after the iOS 27 update.
• “I need an antivirus app to remove it.” No. The steps above remove the pop-up, and Apple’s advice for scam pop-ups doesn’t involve any app. Be wary of “cleaner” or “security” apps advertised by these pop-ups.

If You’re Worried a Partner or Family Member Has Access to Your iPhone

A scam pop-up is not a sign that someone you know is watching you. But if you’re concerned that a partner, ex-partner or family member can see your location, messages or accounts, think about your safety before you change anything. Removing someone’s access or changing passwords may be noticed by them. If you’re in danger, contact local emergency services or a domestic abuse support service in your country first.

Apple’s Personal Safety User Guide explains how to review who can access your devices and information. On iPhone, Safety Check is in Settings > Privacy & Security > Safety Check. Manage Sharing & Access lets you review what you share with people and apps, and Emergency Reset stops sharing with everyone at once. Safety Check also has a Quick Exit button that returns you to the Home Screen.

How to Avoid Scam Pop-Ups in Future

• Keep Block Pop-ups and Fraudulent Website Warning on, and keep iOS up to date.
• Don’t tap ads that promise prizes or warn about viruses, and touch and hold a link in a message to preview where it goes before you open it.
• Never add a website to your Home Screen, allow its notifications or subscribe to its calendar unless you trust it.
• Use a strong, unique Apple Account password with two-factor authentication, and turn on Stolen Device Protection.

The Short Version

An “iPhone hacked” notification in Safari is a scam ad, not a real warning. Close the tab without touching the pop-up, clear Safari history and website data, and turn on Block Pop-ups and Fraudulent Website Warning. Remove any spam calendar, web app or profile it left behind. If you typed a password or card details into the page, change the password and contact your bank. For real account worries, use Apple’s own pages and iforgot.apple.com, and ignore anyone who offers to “recover” your account for money.

Official sources: Apple Support: Recognize and avoid social engineering schemes and Apple Support: If you think your Apple Account has been compromised. More guides to protecting your accounts and devices are in our Security & Privacy section.

Frequently Asked Questions

More iPhone fixes, including iOS 27 problems, are collected on our iPhone & iOS 27 Problems page.

Related guides

• How to Check if Your Password Was Leaked (2026)
• iPhone Hot After the iOS 27 Update? What to Do
• How to See Who Is Connected to My Wi-Fi (and Kick Them Off)