“A password reset request was sent…” System-level phishing

apple-idnotificationspasswordSecurity

Over the course of the last two days I have received upwards of ten notifications alerting me that a password reset request was sent from some device. When I go to check my Apple ID email, I see no notifications to this effect. When I click the "Show" button, I am taken to System Preferences and given the opportunity to type in my administrator password to reset my Apple ID password. I have not done so.

The full message of the notification reads: "A password reset request was sent from a device at the location shown below."

I have a hard time believing this is a legitimate communication from Apple. The few others who have posted similar questions here and elsewhere have received unhelpful answers. Any idea what's going on here? Has my system been compromised somehow?

10.15.7 (19H2)

"A password reset request..."

Best Answer

I suggest changing your iCloud password and enabling 2-factor authentication if you haven't already. But DO NOT click the notification to do this. Go to Apple's website to do it. (Also, don't trust anyone on the internet to give you a good link. Check your URL bar to make sure you are at appleid.apple.com when you click even my link.)

Also, go to System Preferences -> Notifications and see what apps have notification access and restrict notification access to anything that looks suspicious.

Judging by the way the notification looks, it does not look legitimate as it does not have an app icon. You can call Apple if you want to make sure, though.