Locked Out: How a Gift Card Purchase Destroyed an Apple Account
Key topics
A user's Apple account was allegedly destroyed after a gift card purchase, sparking a lively debate about the perils of gift cards and the risks of centralized digital identity. Commenters weighed in, with some advising to never touch gift cards and others pointing out that they can be a thoughtful way to ensure the recipient uses the funds for a specific purpose. As one commenter noted, the real issue is the increasing centralization of digital identity, which can lead to Kafkaesque nightmares when accounts are compromised or locked. The discussion highlighted the importance of managing risk exposure and making informed decisions to mitigate the consequences of digital identity mishaps.
Snapshot generated from the HN discussion
Discussion Activity
Very active discussionFirst comment
5m
Peak period
42
Day 1
Avg / period
14.7
Based on 44 loaded comments
Key moments
- 01Story posted
Dec 16, 2025 at 9:01 PM EST
26 days ago
Step 01 - 02First comment
Dec 16, 2025 at 9:06 PM EST
5m after posting
Step 02 - 03Peak activity
42 comments in Day 1
Hottest window of the conversation
Step 03 - 04Latest activity
Dec 26, 2025 at 11:29 PM EST
16 days ago
Step 04
Generating AI Summary...
Analyzing up to 500 comments to identify key contributors and discussion patterns
Want the full context?
Jump to the original sources
Read the primary article or dive into the live Hacker News thread when you're ready.
same for amazon gift cards
For some reason every card I put in wasn’t accepted, and then my 10 year old Amazon account was banned. I was even using a Fire TV at the time with the same account. Had to create a new account. Very annoying.
I tried around 10 years ago, repeatedly would provide a password, get a notification, click on it, get asked to type my new password.. and get told the password was invalid.
Anyways, I moved on with my life. I was only reminded of it this year when I got referred for a job at Apple.. and guess what, I still can't make an Apple ID. So now I can't ever get a job at Apple :) Oh well, first world problems.
Big tech has repeatedly shown that they are willing to ignore life destroying account workflows so long as they only impact a minority.
Sometimes this has failed, because the entity uses some third-party validation service that can find no record anywhere of the existence of the new email address. So it's sometimes impossible to register a new account somewhere unless you use an email address that is "known" to the validation system.
I'm not sure what "problem" they were trying to solve by doing it this way, but they've created a new problem by doing it.
Also, sometimes I've tried to use very short email addresses such as: x@xxx.com, and they're flagged as invalid even though they're not.
I host my own e-mail. Valid SPF, not on any spam blacklists, good reputation score on my static IP.
At the beginning of November, I lost the ability to send e-mail to Gmail - it was all rejected as, quote, "possibly spammy". Double checked SPF and DMARC... Double checked documentation... Spent time setting up DKIM on my mail server, even though I sent nowhere near enough mail to merit it. Nothing got through for two weeks.
Google Postmaster Tools were totally unhelpful, telling me _that_ I was being blocked, but not _why_ I was being blocked. There is a community support forum where I posted - it hasn't seen a response since I posted in November. There was also a support portal where I could, in theory, contact a human. I sent something in there, and am still awaiting a reply.
Now remember, Gmail isn't just for @gmail.com addresses. Gmail hosts my accountant's domain. Gmail hosts the domain for a club that I'm part of. Gmail hosts friends who also have their own domains. Gmail hosts... well, probably a solid half of the Internet's e-mail.
My only way out of this nightmare was to reach out to a contact at Google, who - having an @google.com e-mail - was also unable to receive e-mail from me, and made the case to the right folks internally that I couldn't send important messages to him. A few days later, I could magically send e-mail to Google again.
Do I have any idea what I did? No. Do I have any idea what they resolved? Also no. Can I prevent it in the future? Who knows!
In the header for the bounce messages was included a description of the problem (as they perceived it), and a link for background reading.
I never followed up on it personally (that wasn't my job anymore because reasons), but the bounces seemed descriptive-enough for someone who was paid to care about it to make it work.
Was that not the case for you?
The core of the flaw is that actual fraudsters and spammers are repeat players and ordinary people aren't. The bad guys expect to be blocked, so they test for it. They check if their messages are getting through and then notice immediately when they stop. Whereas real people expect their messages to go through, because why wouldn't they when they've done nothing wrong? And then become isolated and depressed because it seems like everyone they know is suddenly ignoring them.
The bad guys create thousands of accounts and play multi-armed bandit, so when some of them get blocked they can identify why by comparing them to the ones that didn't, or create new ones and try new things until something works, and thereby learn what not to do. Whereas real people have no idea what sort of thing is going to arouse the Dalek either before or after their primary account is exterminated.
So it's a practice that creates a large increase in the false positive rate (normal people have no way to know how to avoid it) in exchange for a small decrease in the false negative rate (bad guys figure it out quickly). In a context where false positives cost a zillion times more than false negatives because the bad guys treat accounts as a fungible commodity they acquire in bulk whereas innocent people often have their whole lives tied to one account.
And all of that is only disguising the real problem, which is that people get blocked having done nothing wrong. If you were expected to point them to the spam they sent or the fraud they attempted then you wouldn't be able to do it when they'd done no such thing, and then "we can't tell anyone because it would help the bad guys" is used to paper over the fact that you couldn't tell them regardless. When the decision was made by an opaque AI and then reviewed by no one, there isn't actually a reason, there's just a machine that turns you off.
Basically, Google are shadow-banning me till they get caught. I think this should be illegal.
I realize this sounds out there, but I'm not entirely joking. I feel there is a significant subset of all people that are not particularly happy with the direction of society at large. And the great thing about places like the US is that you're free to develop your own little sub-societies. There's no reason a group of like-minded people could not work to develop a technologically embracing society, but one that aims to focus more on decentralization, and utilizing digitization as a convenience rather than a necessity.
Think about something like a 'Google Smart City' except from an entirely different ideological foundation, such that the entire project doesn't sound like something out of Black Mirror. The reason this would be beneficial as a social project, instead of the vastly more viable independent one, is that a lot of tech is generally seen as undesirable, certainly in certain contexts (like smartphones at school), yet it spreads virally making its adoption a defacto necessity. Get rid of the virality and you could create a better life, and a better situation, for many people.
Get a bunch of hackers and DIY small farm folks etc. to move to the same place with the goal of disentangling themselves from megacorps. To begin with it increases the local concentration of people who want that and then causes local businesses and agencies to start serving their needs better because they're a higher proportion of the local population. And it puts the people so inclined in closer proximity to each other which improves coordination.
If you got enough of them you could even affect local ordinances and then e.g. pass strong right to repair laws or laws against businesses requiring you to use one of the major phone platforms. How many localities would need a law against remote attestation before companies would have to stop using it against people?
At this point Big Tech is only scared of the government, so keep that in mind --- the Amish may be on your side.
But yeah, I'm not looking forward to the day I need to show a Google or Facebook account to receive government services. US Visa applications are already going in that direction.
(passwords should be hashed...)
- limits on the length
- limits on the characters
- blocking paste
- weird limits on the email
This is a sign of a lack of real competence
I create a new throwaway Apple ID every time I get a new phone - every 18-24 months I suppose.
When I get a new phone I start with a new email address, sign up for a brand new US Mobile SIM card with that email, use that SIM card+email to create a new Apple ID ... then bootstrap the phone and log out of icloud. I don't tend to interface with Apple at all after that.
Apple has no idea what my actual phone number is[1], nor my real name or anything else about the pseudonym. The birthday is always 1970-01-01, naturally.
[1] My phone number is hosted in the cloud. Apple only sees the ephemeral SIM card number.
Sounds like an egregious EEO violation then.
Is this actually a requirement to work at Apple? What is the legality of employers demanding their employees agree with unrelated-to-their-job terms and conditions? I mean, one of these conditions is that you settle all disputes with them through arbitrators of their choosing, that would be crazy if true.
We live a dystopian world where a trillion dollar company can’t fix the account. Worse than that, out of their several hundred thousand employees, not a single one is capable or willing to fix it.
Speaks volumes about our species in general and where we are headed.
When the executives go on their spiritual retreats or their boondoggle get togethers to talk about company values to the employees; it would all seem so pointless and hypocritical when they can’t fix situations like this.
I filed a bug report about an issue in Google Maps once; this had to have been around 2006.
A little over a decade after that, they emailed me and let me know that they'd fixed it.
That's support -- right? (Right?)
:)
I hope that's not the typical experience, but it's certainly mine.
Here in Australia those laws are pretty decent.
Broadly, as a consumer you can claim a warranty repair for the expected serviceable lifetime of an item. Not just whatever arbitrary time a company decides to set.
However, it’s not clear to me what the situation is for virtual goods. Certainly for games, because of consumer laws, we can claim refunds on Steam for games that are below expectations .
So when I’m paying for a cloud service and the company vending the service decides to freeze my account, I should be able to replace the issue under consumer protection laws.
Claiming that a companies T&Cs allow them to do as they please is not acceptable in many countries for physical goods.
As a technologist my whole life, I am at the point now where I really am over it.
I’m slowly developing a strong unpleasant feeling towards US tech companies and their leadership in particular. :-(
From their bsky account, maybe.
[1] https://bsky.app/profile/hey.paris/post/3ma3of537kk2d