Identifying Phishing Scams in text messages

I just received a text message as an [Apple Security Alert] stating,

we have noticed that your Apple id was used at “APPLE STORE” for $143.95, paid by Apple Pay Pre Authorization.

This appears to be a phishing scam?


[Edited by Moderator]

iPhone 13, iOS 17

Posted on Aug 8, 2024 5:51 AM

Reply
Question marked as Top-ranking reply

Posted on Aug 8, 2024 7:11 AM

phishing That's not an Apple telephone number.


Fraudsters are getting very good at imitating Apple messages and sometimes the only indication in an email is very subtle. Have a look at this thread. https://discussions.apple.com/thread/255639814 It can be very hard to tell from an email alone if it is authentic. The best way to check is to use an independent way through Apple's own resources to confirm what the communication claims. Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. These support articles have some guidelines:


About identifying legitimate emails from the App Store and iTunes Store --> Identify legitimate emails from the App Store or iTunes Store - Apple Support


Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support


Avoid scams when you use Apple Cash --> Avoid scams when you use Apple Cash - Apple Support


About Gift Card Scams --> About Gift Card Scams - Official Apple Support


If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Try to use an Apple resource you know is valid to independently verify what the message is claiming. Go to a support article page on apple.com and use the instructions in the article to verify though Apple itself, or use an Apple device feature such as Settings or an Apple app. To ask Apple start at this web page: Official Apple Support


- Apple e-mails address you by your real name, not something like "Dear Customer", "Dear Client", or an e-mail address* However, having your actual name is not proof this isn’t phishing. Compromised databases may have your name and address in them.

- Apple e-mails originate from @apple.com or @itunes.com but it is possible to spoof a sender address. "Apple email related to your Apple ID account always comes from appleid@id.apple.com." - About your Apple ID email addresses - Apple Support

- Set your email to display Show Headers or Show Original to view Received From. Apple emails originate from IP addresses starting with "17.".

- Mouse-over links to see if they direct to real Apple web sites. Do not click on them as this just tells the spammer they have a working e-mail address in their database. If you are unsure, contact Apple using a link from the Apple.com web site, not one in an email.

- Phishing emails may include account suspension or similar threats in order to panic you into clicking on a link without thinking. They may report a fake purchase in order to infuriate you into rashly clicking on a false link to report a problem. March 2018 post by Niel There was a fraudulent order on my apple … - Apple Community - "Emails saying that your Apple ID has been locked or disabled are always phishing. If one actually gets disabled, its owner will be told when they try logging into it instead of through email."

- Apple will not ask for personal information in an e-mail and never for a social security number.

- Scams may have bad grammar or spelling mistakes.

- Apple will not phone you unless it is in response to a request from you to have them call you.


* Exception: I got email saying my ID is expired! Does… - Apple Community


Forward email attempts as an attachment (in MacOS Mail use the paperclip icon) to: reportphishing@apple.com then delete it.


If this is with regard to a supposed purchase, this Apple article has relevant information and web links for checking if you really have made a purchase or paid for a subscription: If you see ‘itunes.com/bill‘ or an unfamiliar charge on your bank, credit card, or debit statement - Purchases made under Family Sharing might be charged to the organizer's card but will not appear under the organizer's purchase history or subscriptions. Ask family members about those or check your receipts. --> If you see 'apple.com/bill' on your billing statement - Apple Support Apple will email a receipt to the Family Organizer if a purchase is made on a card held by the Family Organizer. This will have the Apple ID of the purchaser, which you should recognize, but won't have specific about what was purchased.






Similar questions

238 replies

Dec 9, 2024 11:14 AM in response to RooC9

Just got this text today. Glad I came here to check to see if it’s a scam.


Apple Approval Notice




We have noticed that your Apple iCloud id was recently used at \"APPLE STORE - CA\" for $143.95, paid by Apple Pay Pre Authorization. Also some suspicious sign in request and apple pay activation request detected. That looks like suspicious to us. In order to maintain the security and privacy of your account we have placed those request on hold.  If NOT you? talk to an Apple Representative. Failing may lead to auto debit and charge will not be reversed. Call +1 866325xxxx immediately to cancel this charge.




Billing Department


Have a great day!


[Edited by Moderator]


Jan 27, 2025 8:48 AM in response to pfhughes

pfhughes wrote:

The phone number on this scam text is a Hawaiian area code. Hmm!


The calling numbers shown are not those of the sender, just as the sending email addresses are not those of the sender. They’re fakes, or they’re appropriated-by-the-spammer real addresses of somebody else unrelated.


If the calling numbers were real, or if the sending email addresses were real, they could be easily blocked.


In some cases, the numbers or addresses are real, but they’re not the spammer’s. The sending numbers or sending email addresses can be associated with some unrelated-to-the-spam-itself person that the spammer wants to get others to harass and bombard with angry replies and “unsubscribe” me replies. Basically, some spammers use the anger of the recipients to harass somebody.


Or the spammer will send manufactured information — propaganda, lies, whatever — intended to turn the recipients against the sender, or to fleece the recipient, all by forging the sending info, and quite possibly also by posting similarly false websites and embedded links. Politics, propaganda, manipulation, fraud, all sorts of motivations to lie. Phishing mail and other sorts of fraud also works like this, including with well-crafted fake “login portal” websites, too.


I had somebody forge one of my email addresses in their spam runs years ago, and I got immense numbers of returned email message errors from misconfigured email servers, and errors and replies and for days, and that from a much smaller spam run and from a much smaller internet. The computer spent all its time just receiving the backwash of that spam.


You can trust certainly, but verify. We’re all unfortunately swimming in fraudulent email and SMS messages, and in the ever-increasing tsunami of AI-generated text spewage.

Jan 27, 2025 9:02 AM in response to MrHoffman

MrHoffman wrote:


You can trust certainly, but verify. We’re all unfortunately swimming in fraudulent email and SMS messages, and in the ever-increasing tsunami of AI-generated text spewage.

This isn’t new. Around 20 years ago a close friend who was writing a techno-thriller asked (by email) if it was possible for someone to send an email that appeared to be from his protagonist Jon Knox, but was actually from a agent of a secret organization. My reply to him came from Jon Knox.

Jan 27, 2025 2:05 PM in response to Lawrence Finch

Lawrence Finch wrote:


MrHoffman wrote:


You can trust certainly, but verify. We’re all unfortunately swimming in fraudulent email and SMS messages, and in the ever-increasing tsunami of AI-generated text spewage.
This isn’t new. Around 20 years ago a close friend who was writing a techno-thriller asked (by email) if it was possible for someone to send an email that appeared to be from his protagonist Jon Knox, but was actually from a agent of a secret organization. My reply to him came from Jon Knox.


An old mail system often sent messages to the recipients server synchronously line-by-line, as the user entered their lines of text. I tapped into the receiving mail server, and was answering arriving messages before the sender even finished mailing their message to me.


In this era, you can do the same thing with, for instance, reading web input form input data before the user saves the form.


Digitally signing more recent mail messages (S/MIME) is slightly tougher to fake, though.


But it’s just far easier to simply lie to the recipients, and some number of recipients will believe the lie. Much like the ongoing “pervert” sextortion scam, and other scams.

May 28, 2025 9:08 AM in response to RooC9

Hi there,

I am so happy i came here and seen this comment. I just got the same Text out of no where and was questioning the #. This came into my phone with a myr******b9@poftoday.com (Apple Approval Notice) at 11:10 AM - I am in Ontario Canada - Message as follows


We have noticed that your Apple iCloud id was recently used at APPLE STORE CA for $143.95 paid by apple pay pre auth. Also some suspicious sign in request and apple pay activation request detected. That looks like suspicious to us. In order to maintain the security and privacy of your account we have placed those requests on hold. your photos data bank information and cards are at risk. If NOT you? talk to an apple rep. Failing may leas to auto debit and charge will no be revered call +188******38 immediately to cancel charge


Billing department: Subscriptions and Billing - Official Apple Support Have a grate day!



I've of course Deleted and reported Junk but i have NEVER got anything like this BF.. I get a lot of fake auto e-transfers from LEXX WEBBER , Linda Forsyth , WAYNE THOMAS , DIAN MCLOUGHLIN, wayde

(usually says one of them has deposited (said amount) check emails OR it says I've successfully deposited in their account check email for details... I always check email nothing is there.. Why is this happening??


Has anyone else got these before? Please HELP!!!!!!!




[Edited by Moderator]


This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Identifying Phishing Scams in text messages

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.