Phishing site after theft

Question

Level 1

8 points

Phishing site after theft

Hi,

My wife's iPhone was recently stolen and turned off.

I used my device for switching her phone to "lost mode", and entered my phone number in the "lost message" which was to be displayed on the stolen device's screen when turned on.

Few hours afterwards I started receiving the following text messages from "Apple" to my device:

---

Apple Customer,

Your lost iPhone XS Silver linked to <my wife's apple ID> has been found and temporarily connected to iCloud. View location: map.mobiles-location.com

---

Clicking the link above opened up a web page which tries to imitate iCloud, asking for an Apple ID user credentials.

A day afterwards, the following message was sent to both me and my wife's replacement phone:

---

Apple has detected an unauthorized access to your account <my wife's apple ID>

Please verify your account now

map.mobiles-location.com

---

It's a good thing we both turned on the two-factor authentication - but still, apple needs to eliminate such danger in order to prevent hacking stolen devices.

iPhone XS, iOS 12

Posted on Feb 27, 2019 1:25 AM

Reply

Answer 1

Top-ranking reply

King_Penguin

Level 10

334,186 points

Feb 27, 2019 2:35 AM in response to yoramlevi

Have you forwarded the text to Apple ? If not Apple obviously won't be able to do anything about it.

Phishing and similar emails : Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams - Apple Support

Genuine iTunes emails : Identifying legitimate emails from the iTunes Store - Apple Support

Reply

Answer 2

yoramlevi Author

Level 1

8 points

Feb 27, 2019 9:55 AM in response to yoramlevi

Another update:

I've informed apple of the above. No reply yet, though (they're putting more pressure in order to be able to sell the phone instead of its parts - as now they are using my wife's first name, and mention a capital city as its current location).

In the mean time i got two new text messages, referring me to a new domain (mobiles-icloud.com) they must have opened instead of the one just closed by the server admin.

I'll inform apple and contact the server admin regarding the new domain.

Reply