Using Apple's Hide My Email on a foreign rail app meant the activation code never arrived, and my passport number stayed locked in an account I could not log into or detach. Apple's relay needs the sender's domain whitelisted and passing SPF and DKIM, and one missing small-operator setting means the mail is dropped. Avoid Apple sign-in for public services.
1. How it happened
I was registering for a local rail booking app. The Apple sign-in prompt appeared and I chose Hide My Email without a second thought.
Apple's privacy mechanism is genuinely well built. It does not hand your real address to the developer. Instead it generates a relay address (something like xxxx@privaterelay.appleid.com), and mail sent there is forwarded through Apple to your real inbox.
That is where the problem started. The rail operator enforces strict identity rules — one passport number can only be tied to one active account. I completed the identity step and waited for the activation code. The page spun, and the inbox stayed silent. I checked that mail forwarding was enabled on the iPhone, went through the spam folder, and found nothing.
2. Why it never arrived
Apple operates a strict Email Relay Service. For mail to be forwarded, the developer has to satisfy several conditions:
- Register their sending domain in Apple's developer console
- Pass SPF, DKIM and related authentication on the sending server
- Maintain enough sender reputation not to be classified as bulk or spam
Miss one configuration, or run a mass-mailing server with insufficient reputation, and Apple silently drops the messages. The email is discarded on Apple's servers before it ever reaches your device.
Which produces a closed loop:
- The rail operator's verification email never gets through
- Your account cannot be activated — you can neither log in nor detach it
- Worse, your passport number is now bound to that unactivated account
Registering again produced the message that the passport number was already in use. Halfway around the world, a trip was about to be blocked by a login button.
3. The workaround: register with someone else's identity
With the main passport locked inside the system, arguing with a slow local support line was not going to work in time. There is a seam in how public transport systems are built: the ticket follows the passenger, not the account holder.
An account is fundamentally a wallet for paying and receiving tickets. Provided your phone number has not also been locked, you can:
- Register a clean new account using a family member's passport and a real email address
- At checkout, go to the Passenger Information section
- Enter your own real name and the locked passport number
- Pay and issue the ticket
The resulting e-ticket and QR code correspond to your identity. At the gate and on board, staff compare the passport number on the ticket with your physical passport. Nobody investigates whose account paid for it.
It solves the immediate problem of needing to travel today. Under normal circumstances the account holder and the passenger should match — otherwise changes, refunds and exceptions become far harder to resolve.
4. Four rules
1. Never use Apple sign-in for public services abroad
The more a service involves government portals, local transport, banking, or identity verification — the kind of non-replaceable core credential — the more you should avoid Apple sign-in. Their IT teams are unlikely to have configured Apple's relay correctly, and a single misconfiguration can lock up your identity.
2. Cross-platform users should prefer Google sign-in
By comparison, Google sign-in is far more compatible:
- It uses your real Gmail address with no intermediary, so codes arrive immediately
- It is inherently cross-platform — iPhone or a Windows browser, one click
- Locked identities essentially do not happen
3. If you must use Apple sign-in, share your real email
If an app offers Apple sign-in as the only quick option, then on the authorisation screen change the default from "Hide My Email" to "Share My Email". That bypasses the relay entirely.
| Option | Consequence |
|---|---|
| Hide My Email (default) | Verification codes from third parties will often never arrive |
| Share My Email | Messages go straight to your real inbox |
4. If you are already locked out
- Detach and retry: iPhone Settings → your Apple ID → Sign in & Security → Sign in with Apple → find the app → Stop Using Apple ID. Then force-quit and reopen the app to see whether a fresh registration flow appears that uses your real email.
- Register under someone else (emergency): as above — a new account in a family member's name, with your passport in the passenger field.
- Escalate to support: find Contact Us on the operator's site and raise a ticket. Describe it as a system defect that has locked a legitimate passport and is preventing travel, and ask their back-office team to delete the unactivated record and release the passport.
5. Final thoughts
The intent behind these systems is convenience and privacy. But when strict privacy rules meet sloppy implementation, the cost lands on ordinary users who trusted the button.
Since then I have given up on Apple sign-in entirely. For public services abroad, the safest approach remains the boring one: register with an email address and phone number, and set a dedicated password. It costs 30 extra seconds the first time and keeps control in your own hands.
For any overseas registration that involves a passport number, national ID or bank card, register manually with a real email and phone number. Save the one-tap logins for accounts you could afford to lose.
Frequently asked questions
Why does the relayed email get blocked?
Apple requires developers to whitelist their sending domain and pass SPF/DKIM authentication. When configuration is incomplete or sender reputation is poor, Apple classifies the message as spam and drops it before forwarding.
I already registered with Apple sign-in. What now?
Try detaching the app under iPhone Settings → Apple ID → Sign in & Security → Sign in with Apple, then reinstall and retry. If that fails, contact the service and ask them to release the locked credential.
Is Apple sign-in never appropriate?
It is fine for accounts you could afford to lose, such as social or shopping accounts. It is the wrong tool for anything involving a passport, national ID or bank card.
Is registering under someone else risky?
Tickets are tied to the passenger rather than the account, so travelling works normally. Anything requiring account-level changes, such as refunds or rebooking, becomes awkward — which is why it is only an emergency fallback.