Is an email saying my iCloud account was logged into from a different country a scam?

Apple does send genuine security alerts for new sign-ins to Apple ID accounts, but fraudsters create near-identical phishing emails to trick you into entering your credentials on a fake Apple page. These emails are among the most convincingly designed phishing messages in existence. The key distinction is the link destination: Apple's genuine emails direct you to accounts.apple.com, never to third-party domains. If you receive such an email, do not click any link in it. Instead, go directly to appleid.apple.com in your browser, sign in, and check recent activity under 'Security'. If there is a genuine unfamiliar sign-in, you can revoke access there. Always enable two-factor authentication to prevent unauthorised access even if your password is compromised.

The reason this template works so well is that it weaponises good security instincts — the alarm you feel at 'someone signed in from another country' is exactly the reflex the attacker wants, because alarmed people click before checking. The correction is to keep the instinct but redirect the action: alarm should always send you to the account itself through your own route, never through the message that raised the alarm. Checked from inside your account, a genuine alert and a phishing email resolve the same way in under a minute, with nothing at risk.