Identifying Phishing Scams in text messages

phishing That's not an Apple telephone number.

Fraudsters are getting very good at imitating Apple messages and sometimes the only indication in an email is very subtle. Have a look at this thread. https://discussions.apple.com/thread/255639814 It can be very hard to tell from an email alone if it is authentic. The best way to check is to use an independent way through Apple's own resources to confirm what the communication claims. Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. These support articles have some guidelines:

About identifying legitimate emails from the App Store and iTunes Store --> Identify legitimate emails from the App Store or iTunes Store - Apple Support

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Avoid scams when you use Apple Cash --> Avoid scams when you use Apple Cash - Apple Support

About Gift Card Scams --> About Gift Card Scams - Official Apple Support

If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Try to use an Apple resource you know is valid to independently verify what the message is claiming. Go to a support article page on apple.com and use the instructions in the article to verify though Apple itself, or use an Apple device feature such as Settings or an Apple app. To ask Apple start at this web page: Official Apple Support

- Apple e-mails address you by your real name, not something like "Dear Customer", "Dear Client", or an e-mail address* However, having your actual name is not proof this isn’t phishing. Compromised databases may have your name and address in them.

- Apple e-mails originate from @apple.com or @itunes.com but it is possible to spoof a sender address. "Apple email related to your Apple ID account always comes from appleid@id.apple.com." - About your Apple ID email addresses - Apple Support

- Set your email to display Show Headers or Show Original to view Received From. Apple emails originate from IP addresses starting with "17.".

- Mouse-over links to see if they direct to real Apple web sites. Do not click on them as this just tells the spammer they have a working e-mail address in their database. If you are unsure, contact Apple using a link from the Apple.com web site, not one in an email.

- Phishing emails may include account suspension or similar threats in order to panic you into clicking on a link without thinking. They may report a fake purchase in order to infuriate you into rashly clicking on a false link to report a problem. March 2018 post by Niel There was a fraudulent order on my apple … - Apple Community - "Emails saying that your Apple ID has been locked or disabled are always phishing. If one actually gets disabled, its owner will be told when they try logging into it instead of through email."

- Apple will not ask for personal information in an e-mail and never for a social security number.

- Scams may have bad grammar or spelling mistakes.

- Apple will not phone you unless it is in response to a request from you to have them call you.

* Exception: I got email saying my ID is expired! Does… - Apple Community

Forward email attempts as an attachment (in MacOS Mail use the paperclip icon) to: reportphishing@apple.com then delete it.

If this is with regard to a supposed purchase, this Apple article has relevant information and web links for checking if you really have made a purchase or paid for a subscription: If you see ‘itunes.com/bill‘ or an unfamiliar charge on your bank, credit card, or debit statement - Purchases made under Family Sharing might be charged to the organizer's card but will not appear under the organizer's purchase history or subscriptions. Ask family members about those or check your receipts. --> If you see 'apple.com/bill' on your billing statement - Apple Support Apple will email a receipt to the Family Organizer if a purchase is made on a card held by the Family Organizer. This will have the Apple ID of the purchaser, which you should recognize, but won't have specific about what was purchased.

Kriistiina89 wrote:

Has anyone else got these before? Please HELP!!!!!!!

Have others received this? Yes. This is a common scam.

Welcome to the ever-increasing group of people —there are ~thirteen pages of people here in this thread — that have received this same scam message.

Here, the scammers are lying, By lying, I mean, they’re straight up lying to you, lying to get the exact reaction you had, lying to get your money, lying to get you concerned, and, well, lying.

In short, scam.

Ignore it.

Maybe mute all unknown message senders if you want, so they don’t distrust your day.

Here are a very few of the many other common scams: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

And “grate day”? 😜

Retirement2017 wrote:

I received this messageApple Approval Notice

We have noticed that your Apple iCloud id

It’s called an Apple Account, as Apple stopped using Apple ID a while back. Enjoy the brief interlude before the scammers catch up. It’s never been called an “Apple iCloud id”, though.

was recently used at "APPLE STORE - CA" for $143.95, paid by Apple Pay Pre Authorization.

Apple Pay Pre Authorization is word salad.

And that’s also not how payment networks and fraud detection works. If there’s fraud suspected, the transaction is blocked before payment, and only proceeds after explicit approval (from you) is received. The card-holder (you) doesn’t call to block payment, the caller calls to complete the payment, if fraud is suspected.

Also some suspicious sign in request and apple pay activation request detected.

Word salad. Also not how Apple reports issues.

You do have two-factor authentication enabled too, right? If not, go enable that Right Now.

That looks like suspicious to us.

Word salad. Poor grammar, too.

In order to maintain the security and privacy of your account we have placed those request on hold.

Not how this works. Also word salad. Also bad grammar.

Your Photos, Data, Bank Information and Cards are at risk.

That’s not how Apple Pay works. If your Apple Account is breached, sure, you’re headed for a Bad Day.

But you have two-factor enabled, right? That will show a verification code for every new and unexpected login.

If NOT you? talk to an Apple Representative.

“If NOT you ? talk to an Apple Representative” is word salad.

Failing may lead to auto debit and charge will not be reversed.

That’s not how payment networks work. Also not how fraud detection works. Also, bad grammar.

Call +1808203**** immediately to cancel this charge.

Yeah, because Apple is likely to use a number that isn’t toll-free; an 800, . And if you’re still not sure, search for the phone number, and see if it’s associated with shenanigans, or with Apple. And if you’re still unsure, look up the number for Apple in your Wallet or otherwise, and contact Apple.

Arcane technical details: ”Toll-free telephone numbers in the North American Numbering Plan have the area code prefix 800, 833, 844, 855, 866, 877, or 888. Additionally, area codes 822, 880 through 887, and 889 are reserved for toll-free use in the future. 811 is excluded because it is a special dialing code in the group NXX for various other purposes.”

Billing Department :  Subscriptions and Billing - Official Apple Support

Word salad.

Have a great day!

Yeah, because Apple is going to use that “Have a great day!” as its closing, and particularly on a note claiming payment mayhem.

[Edited by Moderator]

Kinda wish here was a moderator for spammers, scammers, and phishers too, but here we are.

A few more of the many sorts of scams: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

And if you’re still unsure if this is real or a scam, look up the Apple-published telephone numbers on an Apple webpage, and contact Apple directly. Email sending addresses and calling numbers can be faked, too.

We get this same message posted regularly in this thread, dozens of times. This scam gets sent to millions of people.

Contact info for Apple, on an Apple webpage: Contact Apple for support and service - Apple Support

kreg56 wrote:

Got the same message exactly with the same amount but only on the iPad and not on the iPhone, I usually reply (on iPhone) that I am calling police before deleting and reporting and it usually stops the scammers.

Hello~ Calling the police? What exactly do you expect them to do? If you are going to call the authorities…please call the non emergency number so someone that may need life saving assistance isn’t denied care or assistance. I can assure you that they (police) get these messages as well. Click on below and review to see exactly what you should in fact do…

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

~Katana-San~

THANKS FOR POSTING THIS! I just got it too — assumed it was a scam — never had received anything like that before from Apple. But was immediately confirmed for me when I googled about the scam, and you'd put "$143.95" in your post, which is the same amount they had in my scam text. Another way the scammers try to get you: it says, "Failing [to call the number] may lead to auto debit and charge will not be reversed" So I went straight to all my payment accounts and there were no flags, no charges...then googled the number to see if it was legit — none of the prefixes matched the normal support numbers for Apple. I didn't click any of the links within the text, but typed the apple support url they had, separately into my browser, and that was the correct url, so we know clicking their link within the text would've given them what they wanted — remember, just because it says a legitimate url DOES NOT MEAN it links to a legitimate url, so NEVER click a live link within a suspicious text. Conclusion: sneaky, perhaps getting more subtle and clever, but just another scam, successfully dodged. I hit "delete/report" junk. And will now go update passwords next.

heyheylissa wrote:

…I’ve never received anything like this before is this fraudulent?…

It’s a poorly-crafted scam, yes.

Ignore it.

Want details? See the previous ~13 pages of replies, here.

Maybe mute all unknown message senders too if you want, so that these scams don’t disrupt your day.

Here are a very few of the many other common scams: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

the1stdm wrote:

There is nothing personal in the original post. Those numbers are from the scammer not mine.

The reason they are redacted is that Google will scrape web pages and the next thing you know you would have a Gemini AI result on the top of a search request telling you to call the number if you received that message. Unfortunately it happens with Tech Support scams where fraudulent numbers are posted in search results and users have fallen victim to those. Google does not take any responsibility for the search results.

For any message/email, the recommendation is to NEVER call any provided number or even click a link and enter personal information. Apple does not sent those SMS messages like that to you and if you ever have any Apple related concern and want to call, then your would use their official Support Page here:

Contact Apple Support - Apple Support

TiredOfDishonestApple wrote:

This is the text message I received yesterday from 1-850-xxx-xxxx:

Your Apple ID was used to make a $155.90 purchase at the Apple Store via Apple Pay . If you didn't authorize this, call Apple Support at  (888) xxx xxxx

::SIGH:: Didn’t you read ANY of the posts in this thread. That is a SCAM MESSAGE and is not from Apple. And neither phone number is Apple’s. If you call either one you will be tricked into handing over the keys to the kingdom; essentially your Apple ID & password, thus giving away all of your private information and risking bricking your iPhone.

[Edited by Moderator]

kreg56 wrote:

Got the same message exactly with the same amount but only on the iPad and not on the iPhone, I usually reply (on iPhone) that I am calling police before deleting and reporting and it usually stops the scammers.

Actually it is not ideal to respond back at all. The sending address is just spoofed and the scammers are not even likely to see your message. For addresses that are monitored, it just notifies them that you are susceptible to respond to their messages and your address is more valuable to be sold to other scammers. They know they can't be tracked down to be identified and the worst thing that could happen to them is that the email provider may close their account. That does not concern them as they can easily create another anonymous email account.

I just received this text message today. Same amount. Here is the message and was sent from a Hotmail account (***@hotmail.com) that came through as a text. Obviously - hotmail would not be an official Apple message 🙄

=====

Apple Approval Notice

We have noticed that your Apple iCloud id was recently used at "APPLE STORE - CA" for $143.95, paid by Apple Pay Pre Authorization. Also some suspicious sign in request and apple pay activation request detected. That looks like suspicious to us. In order to maintain the security and privacy of your account we have placed those request on hold. If NOT you? talk to an Apple Representative. Failing may lead to auto debit and charge will not be reversed. Call +1 ** immediately to cancel this charge.

Billing Department : https://support.apple.com/billing

Have a great day!

[Edited by Moderator]

MaxMom322 wrote:

I just got the same text from a strange email address: When I called the 802 number, the guy on the phone said the 143.95 charge was going to a dark website — basically causing panic. He then told me to download the Connectwise Control app — that has a really poor user rating and he would walk me through the steps on how to remove hen hacks. Regardless I’m letting my credit union know to be on the look pit for any charges out of state. I didn’t give the guy a lot of information.

If you provided remote access into it, the contents of your Mac were probably pillaged. There's not a whole lot you can do about un-pillaging whatever was done there, other than restoring a backup from prior to the access, and changing all of your passwords, including your email server passwords, and your Apple Account passwords.

Without intending offense, you need to work on your skepticism, too.

"DARK WEB", "HACKER", "VIRUS", anything you're reading that includes any of those words is best assumed to be a fraud, a scam, or entertainment, until proven otherwise.

Retirement2017 wrote:

I received this messageApple Approval Notice

We have noticed that your Apple iCloud id was recently used at "APPLE STORE - CA" for $143.95, paid by Apple Pay Pre Authorization. Also some suspicious sign in request and apple pay activation request detected. That looks like suspicious to us. In order to maintain the security and privacy of your account we have placed those request on hold. Your Photos, Data, Bank Information and Cards are at risk. If NOT you? talk to an Apple Representative. Failing may lead to auto debit and charge will not be reversed. Call +1808203**** immediately to cancel this charge.

Billing Department :  Subscriptions and Billing - Official Apple Support

Have a great day!

[Edited by Moderator]

Literally (and I mean literally) MILLIONS of people have received this or similar scam messages. You are not alone. It is sent by bots installed on co-opted computers, mostly Windows PCs.

See→Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams

And NEVER, EVER click on a link in a message or call a phone number in a message.

Hello~ Yes, it’s just scammers doing what scammers do. Delete it and move along . Don’t interact with it at all. Click on below and review…

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Take care.

~Katana-San~

They’re all scams.

“Don't answer suspicious phone calls or messages claiming to be from Apple. Instead, contact Apple directly through our official support channels.”

”To report a suspicious SMS text message that looks like it's supposed to be from Apple, take a screenshot of the message and email the screenshot to reportphishing@apple.com.”

You can report phishing at these links and most importantly your local law enforcement.

• Identify legitimate emails from the App Store or iTunes Store.
• FTC Complaint Assistant
• FBI’s Internet Crime Complaint Center

Learn about how not to be a victim of Social Engineering.

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support