What to do if…
your contacts list suddenly fills with unknown entries or random names

What to do now

1. Pause contacts syncing for the account that seems affected.

   • Turn off Contacts syncing for iCloud, Google, Microsoft, or the work account if you can find that setting.
   • Avoid full Airplane Mode if you still need to receive sign-in codes or important calls.

2. Make a quick record before changing things.

   • Export contacts from the main web contacts page if you can.
   • If you cannot export, take screenshots showing a few unknown entries and the time you noticed them.

3. Check whether the account may be compromised.

   • Look for password reset emails you did not request.
   • Check for new sign-in alerts, unknown devices, changed recovery details, new email forwarding rules, or apps you do not recognise.
   • If any of these are present, treat the syncing account as possibly compromised.

4. Secure the account that syncs contacts.

   • Change the password from a trusted device.
   • Turn on two-step verification or multi-factor authentication if it is available.
   • Sign out unknown devices from the account.
   • Remove third-party app access you do not recognise, especially apps with contacts access.
   • Check email forwarding rules and filters if the same account also handles email.

5. Check whether a work, school, or device-management account is adding contacts.

   • Look for a work email account, school account, shared directory, mobile device management profile, or company address book.
   • If it is a managed device, contact your IT helpdesk before removing profiles or accounts.

6. Compare the contacts on another signed-in device or on the web.

   • Check the same contacts account on a tablet, laptop, or web contacts page.
   • If the unknown contacts appear there too, clean up the web account after securing it, because that is usually the source being synced back to devices.

7. Recover contacts only after the account is secured and recorded.

   • For iCloud, use iCloud.com Data Recovery or Restore Contacts if available; restoring an earlier version may replace contacts across devices.
   • For Google Contacts, use Undo changes if the changes were within the past 30 days.
   • For Outlook or Microsoft contacts, check the People or Contacts Deleted folder and Recover deleted option if available.
   • Avoid permanent deletion until you are sure you have the right account and a usable backup or restore point.

8. Report it if money was lost, fraud happened, or criminal access seems likely.

   • In England, Wales, or Northern Ireland, use Report Fraud, which replaced Action Fraud as the public reporting route in December 2025.
   • In Scotland, contact Police Scotland on 101 for non-emergency reporting, or call 999 if there is an emergency.