you should securely access your account provider's website, find the number to report it, and report what happened. (They may have some FAQ there that tells you exactly what to do in this case.)

Disclaimer: I'm not a cybersecurity expert and while I have a work iPhone, I know next to nothing about Apple stuff. But I can't see where this would be any different than any other account, and reporting a potential access attempt is generally recommended.


* MFA = multi-factor authentication ; your OP sounds like you received a call with MFA code.

Above suggestion is especially true, if you never use 'phone call' for MFA yourself. (yeah, who does that these days?)

Also consider if you have family members or friends who might be a little off the rails trying to access your account, or if you have a potentially common username. I would still report the attempt though.