Is this a scam email?

Question

coxorange Author

Level 1

98 points

Is this a scam email?

Hello,

I just received an email, and because I have recently changed my address

I'm not 100% sure if this is a scam email. (I assume for some reasons that it is!)

=================

Hi Customer,

Your Apple ID will be disable because of some violated policies.

The following changes to your Apple id were made on December 2018

Time & Date : 21 Dec 2018 at 03:18 am utc

Billing information has been changes - Statement in attached file

Status : Billing Verify ID# XXXXXXXXX

We need to verify your account information in order for you to keep continue using you apple id account.

Please the attached file and verify your apple id before 24 hours or your apple id will be disable

Thank You

Apple Team Manage

=============

attached PDF:

=============

Apple SupportHi Customer,

Your Apple ID will Be disable Because of Some Violated Policies

The following changes to your Apple ID were made on 21 December, 2018 at 03:18 am utc

We have noticed that your account information appears to be invalid and unverified.

We need to verify your account information in order for you to continue using your Apple ID Account

You need to sign and verify it as soon as possible, you should do this soon because disabled accounts are eventually deleted along emails, iCloud, and other data stored with Apple

you should change your password as soon as possible from your Apple ID account page at https://appleid.apple.com.

Please verify your identity, we recommend that you go to Verify Now

Sign In

Sincerely, Apple. Support

Apple ID | Support | Privacy Policy

=========

Since this is a PDF I can't see where the link goes, but when I click it,

it gets redirected and finally ends on the REAL https://appleid.apple.com/#!&page=signin page!

How could a scam work if I would enter information there? (of course I didn't)

Many thanks!

iMac Line (2012 and Later)

Posted on Dec 21, 2018 2:11 PM

Reply

Answer 1

Best reply

stedman1

Community+ 2024

Level 10

256,758 points

Dec 21, 2018 2:12 PM in response to coxorange

Yes, it is a scam. Apple would not refer to you as “Dear Customer”, since they know who you are.

Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - Apple Support

Reply

Answer 2

Eric Root

Level 10

684,111 points

Dec 21, 2018 2:38 PM in response to coxorange

They would get your Apple ID, password, and whatever other information you entered.

Apple won't send you an email/text telling you your account is disabled. You will find out the next time you try to log in somewhere.

The e-mail will be from @apple.com or @iTunes.com. E-mail addresses can be spoofed. You can go to Mail/View/Message/Show all Headers to see more. Apple e-mails will never contain an attachment. Apple will never request personal information such as Social Security numbers.

The only exception to the above I have noticed is if you order something from the Apple Store (apple.com), your receipt will be addressed to Dear Apple Customer. That is a receipt for a purchase you initiated.

Reply

Answer 3

coxorange Author

Level 1

98 points

Dec 21, 2018 3:11 PM in response to Eric Root

Thanks for your answers!

> They would get your Apple ID, password, and whatever other information you entered.

How? If I would enter the information on the Apple site (https://appleid.apple.com/#!&page=signin)?

Would a script be running (how?) which would forward the information?

I really can't imagine.

Reply

Answer 4

hasano5

Level 1

4 points

Dec 22, 2018 5:46 AM in response to coxorange

Yes. The other posters mentioned some clues as to what makes it a spam email. However, another really obvious one is the grammar mistakes such as "will be disable", "in order for you to keep continue" and "or your apple id will be disable".

Reply

Answer 5

coxorange Author

Level 1

98 points

Dec 22, 2018 6:48 AM in response to hasano5

> some clues as to what makes it a spam email. However, another really obvious one is the grammar

> mistakes such as "will be disable", "in order for you to keep continue" and "or your apple id will be disable"

I noticed that. What bothers me is: can Safari show a correct domain like xxxxx.apple.com/xxxxx

PLUS the green lock symbol even though I am on another site??

Today I clicked the link again and now it ended at:

https://secure2-appleid.recovery.updatepersonal-infoaccount.support/Auths

and displayed:

Not Found

The requested URL /Auths was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

Apache/2.4.37 (cPanel) OpenSSL/1.0.2q mod_bwlimited/1.4 Server at secure2-appleid.recovery.updatepersonal-infoaccount.support Port 443

Does this explain what they had tried?

Reply

Answer 6

coxorange Author

Level 1

98 points

Dec 21, 2018 6:20 PM in response to Eric Root

It looks like this:

Reply

Answer 7

coxorange Author

Level 1

98 points

Dec 22, 2018 2:37 AM in response to coxorange

I mean doesn't the green lock symbol show that's it's a genuine site?

Reply

Answer 8

Eric Root

Level 10

684,111 points

Dec 22, 2018 5:37 AM in response to coxorange

It still doesn't look correct to me. Notice the location of the sign in box is different.

Reply

Answer 9

Eric Root

Level 10

684,111 points

Dec 22, 2018 6:49 AM in response to coxorange

I used Safari on a 27" iMac. This is using Firefox.

Reply

Answer 10

Eric Root

Level 10

684,111 points

Dec 21, 2018 3:29 PM in response to coxorange

You are welcome. How do you know that is the real Apple web site? It may look like the real thing, but given what you have posted, I doubt it is the real Apple web site.

Reply

Answer 11

coxorange Author

Level 1

98 points

Dec 22, 2018 6:43 AM in response to Eric Root

> It still doesn't look correct to me. Notice the location of the sign in box is different.

Did you use Safari for the screenshot?

(my iMac has a 5K/27" screen)

Reply

Is this a scam email?

Similar questions