Activation Lock screenshots and forged Mac proof: why none of it counts#

An Activation Lock check on a Mac cannot be done from a screenshot. Every "proof" a remote seller can send that a Mac is not Activation-Locked is either trivially forged or does not say what the seller claims it says. The defense is not learning to detect each forgery; it is refusing to accept the proof types that can be forged.

Apple's Check Coverage page at https://checkcoverage.apple.com/ does not display an Activation Lock line for Macs. It shows warranty and AppleCare coverage status. Any screenshot purporting to show a green "Activation Lock: Off" badge on Check Coverage for a Mac is fabricated by definition. Apple retired the public iCloud Activation Lock checker in 2018, so the underlying data does not exist for any third party to look up either. The third-party "Activation Lock checker" sites still advertised online are scraping repair-flow rejection codes at best, not authoritative state. The full reference for the only Activation Lock check that holds up is the buyer-observed boot-state video.

The forgery catalog#

There are six recurring forgery types in used-Mac listings. They cover every "proof of unlock" most buyers know to ask for.

Doctored Find My toggle screenshots. A real screenshot of System Settings → Apple ID → iCloud → Find My Mac is edited to flip the toggle. The tells are pixel artifacts and anti-aliasing inconsistencies around the toggle, inconsistent font kerning in the surrounding labels, and an OS theme (Light/Dark/Auto, accent color, sidebar style) that does not match the macOS version the seller claims. Even an authentic screenshot only proves the toggle was off at that moment. The seller can flip Find My back on before packing the Mac.

Fabricated Check Coverage Activation Lock badges. As noted above, the page does not display this status for Macs at all. Any screenshot showing one was either edited from a real Check Coverage page or generated by an unrelated tool whose output was relabeled. The reference that walks every line of Apple's checkcoverage.apple.com response covers what the page actually returns and why the Activation Lock line is not one of them.

Fake "iCloud unlock" receipts. Pasted invoices from "official Apple iCloud removal services." Apple does not sell, license, or contract any such service, so every receipt of this kind is fraudulent. They appear most often in higher-priced listings where the seller needs to explain why a previously-locked Mac is now "clean." The companion post on why every consumer iCloud-unlock service is a scam covers what these services actually do.

Apple Configurator screenshots labeled "unlocked." Apple Configurator does not display Activation Lock as a green or red status field. The device window surfaces supervision state and Apple Configurator-driven enrollment state, not Activation Lock. A "Configurator screenshot showing the Mac is unlocked" is generally either mis-framed (the seller pointing at a field that means something else) or doctored.

DFU restore videos demoed as "proof of unlock." Apple Configurator's Revive and Restore actions on a DFU-mode Apple Silicon or T2 Mac reinstall firmware and the recovery system. They do not remove Activation Lock if Find My was on. Scammers will sometimes demonstrate the DFU restore on video as if it has cleaned the device; the buyer sees Setup Assistant start and assumes it is unlocked, but Activation Lock will trigger as soon as the Mac reaches network configuration on the buyer's side. A "DFU restore as proof of unlock" is not proof.

Video-call deception. During a live call, the seller briefly turns off Find My, performs Erase All Content and Settings on camera, reaches Setup Assistant, then ends the call. After the call, before packing, the seller signs back into iCloud and re-enables Find My. The device ships locked. The buyer has video of an unlock that was undone an hour later.

A close relative is the "deferred lock" sale, in which the seller completes Setup Assistant with their own Apple ID, creates a local admin account for the buyer, and ships the Mac powered on. The buyer uses it for weeks. The first macOS update, the first Erase All Content and Settings, or the seller signing out of their Apple ID elsewhere causes the Mac to re-contact Apple's activation servers, and the Activation Lock screen, the one explained in the Mac-side guide, appears. The original Apple ID was always the registered owner. The lock was deferred, not disabled. A stolen Mac sometimes reaches the deferred-lock stage by way of the Find My phishing pipeline that clears stolen Macs server-side.

Why no static proof is sufficient#

The unifying problem is temporal. A screenshot shows a state at a moment, not the state at shipment. A live video of an erase shows a state at the moment of the call, not the state when the package is sealed. Even if every still image and every minute of recorded video is authentic, the seller can change the Mac's state in the gap between the recording and the shipment.

Server-side Activation Lock state, the only state that actually decides whether the Mac will boot for the buyer, lives on Apple's iCloud activation servers. No public page returns it for a Mac. The Mac itself can be re-locked from any device the seller signs into https://icloud.com/find with after the call ends. The window between "I just showed you the unlock on video" and "package goes on the truck" is exactly the window in which the lock can be reapplied.

What actually counts as proof#

The defensible proof is procedural, not screenshot-based. Three elements together close the temporal gap.

The first is an unbroken dated video of the full flow on the seller's side. The seller opens System Settings → Apple ID → iCloud and shows their own name and email at the top of the page (this prevents the "signed into a throwaway Apple ID" trick). They toggle Find My Mac off, entering the Apple ID password on camera. They open System Settings → General → Transfer or Reset → Erase All Content and Settings and run it. They reach the Setup Assistant "Hello" / language / region screens with no Activation Lock prompt. They hold up a paper with the day's date and the buyer's marketplace username in frame. They power off and pack the device on the same continuous video, all the way through sealing the box and applying the shipping label.

The second is independent verification by the buyer. On receipt, the buyer runs the received Mac's serial on https://checkcoverage.apple.com/ to confirm Apple's records list the model and configuration the seller claimed. Decode the model identifier and configuration on https://everymac.com/ to confirm the chip family, base RAM, and base storage match the listing. Neither page shows Activation Lock state; both confirm whether the device is what the seller said it is. A mismatch between Apple's reported model and the seller's listing is independent evidence of fraud, regardless of what any prior screenshot showed.

The third is an unbroken unboxing and first-boot recording on the buyer's side. Record the packaging on arrival before opening. Photograph the case-bottom serial against the shipping label and box. Power on; if Setup Assistant proceeds without an Activation Lock or Remote Management screen, the Mac is genuinely clean. A cellular hotspot is preferable to the buyer's home Wi-Fi for the Setup Assistant network step, because it removes any possibility that a previously-installed bypass redirects Apple's activation domains via the local DNS or hosts file.

If anything is wrong on the buyer's side, the unboxing video is the evidence that goes into the marketplace dispute, the credit-card chargeback, and (if the device turns out to be stolen) the police report. Archive the listing at https://archive.today or https://web.archive.org before the seller deletes it.

What this means for the reader#

The lesson is not "learn which forgeries to spot." The lesson is that the proof types most buyers ask for cannot be made trustworthy at any level of forensic skill. A flawless screenshot of a Find My toggle, a flawless Check Coverage screenshot, and a flawless DFU restore video can all be produced by an honest seller and a dishonest seller alike, and the dishonest seller can re-lock the device after the recording ends.

The proof types that close the gap are the ones that require the seller to commit to a recorded continuous action and the buyer to verify state on their own hardware after taking possession. Refusing to accept anything short of those two things is the entire defense. A seller who balks at the unbroken-video request, who offers a Configurator screenshot or a Check Coverage badge or a DFU restore demo instead, has failed the test before the transaction begins. The one form of seller-provided proof a forgery can't reach is one signed by the Mac's own hardware: a Macfax report the seller runs is hardware-attested rather than a screenshot, and the buyer re-verifies the signature on the device at handoff. The pillar guide on MacBook scams when buying a Mac ties this defense into the rest of the pre-purchase protocol.