“KrebsOnSecurity tested Ken’s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices.”
Apple’s iforgot page needs an email address, a CAPTCHA and a phone number, and then it fires system prompts at every device you own. One target declined more than 100 of them. Then came a call spoofing Apple’s real support number, from a caller holding a people-search profile. A senior Apple engineer told one victim a recovery key would stop it, and it doesn’t. Microsoft fixed push bombing after LAPSUS$ hit it in 2022. Apple has no rate limit.