You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

📰 Newsroom Update

Billie Eilish is Apple Music’s Artist of the Year for 2024. Learn more >

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

iTunes store account hacked

I'm posting this just to share my story and get reactions. It's a little detailed but I thought worth sharing.

On November 23, 2010 I purchased a single song from the iTunes store for .99. I used store credit that I had from a gift card I received last year. It was the first purchase I had made since July 2010.

On November 25, 2010 I received a receipt for 2 more separate orders to my account. These were for over $50 in iPhones apps. Here's a sampling of some of the purchases:

1 eREAD isoshu, v1.5, Seller: ChengDu YueTong Internet Information Co. Ltd (17+)
2 Plants vs. Zombies, v1.3, Seller: PopCap Games, Inc. (iDP)
3 Monkey Island 2 Special Edition: LeChuck's Revenge, v1.1, Seller: Lucasfilm International Services Inc.
4 Asphalt 5, v1.2.6, Seller: Gameloft (9+)
5 Let's Golf!® 2, v1.0.1, Seller: Gameloft (4+)
6 Frames & FX for Photos, v2.5.1, Seller: Imikimi, LLC (12+)
7 Stenches: A Zombie Tale of Trenches, v1.0.1, Seller: Thunder Game Works (9+)

I do not have a credit card linked to my account, so these were made using my store credit.

I have only 1 computer authorized for my account (my personal home computer). I live alone and no one else touches my Powerbook but me. I also DO NOT own an iPhone, so I would have no interest in apps.

After I saw these bizarre purchases, I checked my account. I noticed 2 strange things: My account information had changed: My street address was correct, but city, state and zip had changed to: Towson, MD 21286-7840. I have never lived in Maryland. Also, I noticed that my password recovery answer had changed to "Murray" in response to a question about my mother's maiden name. That's decidedly NOT my mother's maiden name. Also, my birthdate had changed to an incorrect month and day.

I immediately changed my password and my recovery question/answer challenge.

I reported problems on all of these purchases and also contacted iTunes Account Support by e-mail.

Within 24 hours I received an e-mail from "Vicki" at iTunes Customer Support. She wrote:

"When reviewing over your account "name@domain.net" and the two reported orders, it shows that the content purchased within them was acquired from the computer that is currently authorized for your iTunes account. So I strongly advise that you do consult with those in your household regarding the purchases made, and the charges that resulted from those purchases."

Further:

"I have gone and reversed the charges for the two orders....You will see a store credit in three to five business days....Please note that this is a one-time exception, as the iTunes Store Terms and Conditions state that all sales are final."

I am pleased that Apple is refunding my store credit and replied so quickly.

However, it is simply impossible that these purchases were made from my computer. Again, my Powerbook is the only computer I have ever authorized to access my account, and I am the only person with access to it.

I am not sure how this happened. Any thoughts or similar experiences?

Powerbook G4, Mac OS X (10.5.8)

Posted on Nov 28, 2010 3:43 PM

1,958 replies

Andi...M

Level 1

0 points

Mar 19, 2011 7:34 PM in response to stereocourier

It happened to us too. Our credit card was charged $40.00 twice the cc company declined the charge and put a freeze on the account thankfully or else we probably wouldn't have even noticed the charge. Nothing in our account was changed and nothing shows in our account history.

I'm not sure how to go forward with payment info since gift cards and Paypal are being compromised as well. I contacted i-tunes but I'm expecting the same canned response they gave everyone else. "Change password..." I hope they realize the need to address this properly. There is no way to feel secure with i-tunes now and even more so if the company sweeps this under the rug.

HELLO ITUNES LET'S ADDRESS THIS PUBLICLY NOW

arcane93

Level 1

29 points

Mar 19, 2011 7:45 PM in response to Andi...M

Ok, that's just weird . . . So some people are having multiple gift cards charged to their credit card, while others are having their credit card info removed from their profiles? And still others are having credit card numbers that don't belong to them put on their account to make fraudulent purchases?

I think we've got multiple hackers operating here . . . It's entirely possible that they're all exploiting the same weakness (whatever it might be) to get in, but the different +modi operandi+ at play here would seem to indicate that there are different people at work.

I guess I feel fortunate that I'm in the group that just had the credit card numbers removed from their accounts. I've been watching my credit card activity, and I haven't seen anything show up on it. Still, I don't think I'll be adding my card back onto my account anytime soon.

Andi...M

Level 1

0 points

Mar 19, 2011 8:10 PM in response to stereocourier

Found this on another site... this poster makes some good points

" My iTunes account was compromised 2 days ago by a malicious app running on my iPhone. Not enough room here to go into all the details, but sufficient to say that the Malware embedded in a “legitimate looking” app downloaded another app unbeknownst to me which immediately made a single purchase in the iTunes store. Sort of a trial run, I guess. The software laid dormant for about 10 hours, then proceeded to make 25 additional purchases from the iTunes store for exactly $64.93, all in the space of 30 minutes. Thats over $1600. I’ve only made ONE previous purchase from iTunes. Shouldn’t this have raised a red flag. Guess not, because the sale proceeded directly to my PayPal account, then directly to my Credit Card and Bank Account. JPMorgan Chase Bank fraud police shut down the transactions to my Credit Card after 7 transactions (at least someone is paying attention), but the next day, Paypal ran the charges thru my secondary payment option, my bank account, because they looked like legitimate charges from a “verified seller”. Long story short, the iTunes store did issue a Reversal of the charges to PayPal, now I’m waiting for the money from my credit card and bank account to settle in PayPal so they can issue me a refund. The folks at JPMorgan Chase Bank and PayPal have been very helpful. Apart from their initial “got your complaint” e-mail, Not a peep from Apple and it’s now 52 hours into their 48 hour response. Guess their too busy sweeping this fiasco under the rug. Oh yeah , that thing about changing your ITunes password…what good is that going to do if the MALWARE is running on your phone waiting for you to download another App where you HAVE TO TYPE IN YOUR ITUNES PASSWORD. Changing your password is a waste of time. And before the Apple dumpling gang starts attacking me…this was a brand new 3GS iPhone (my old iPhone broke 2 weeks ago) running the latest OS4 (Hmmm part of the problem? TSR programs & malware running in the background? Where Task Manager when you need it?) and iTunes 9.2.0.61. I own Macs and PCs and I love my iPhone, but Apple has a real problem with their App screening and a bigger problem with customer service."

arcane93

Level 1

29 points

Mar 19, 2011 8:45 PM in response to Andi...M

Hmm . . . I'm suspicious of that story for a couple of reasons . . .

First, what the poster describes happening is much more severe than what anyone is reporting here. The most anyone is reporting being charged for here is two $40 gift cards. That's a lot different from over $1600 in charges in 25 purchases. It seems like the hackers that we're talking about in this thread are being careful to charge small amounts to make it less noticeable (for everyone in this thread noticing this happening, I'll bet there are more than a few people who will never look close enough to see it). There's no way someone's going to miss $1600 for long (if nothing else, as he notes, his credit card company shut it down pretty quick).

Secondly, he claims this was done by a "malicious app" downloading "another app" -- yet he completely fails to name either one. I would expect that the first thing that you'd want to do in posting something like this would be to warn others to stay away from the app(s) in question. Failing to name the problem app at all makes the post totally useless for anything other than venting -- if, indeed, it actually happened. I would be curious to know how he even knows that this is what happened. He gives no information whatsoever to indicate that he knows what he's talking about.

I mean, yes, I agree with his points that Apple is failing in both the app screening and customer service departments. I have my strong suspicions that the source of the problem is a compromised app (or apps) as well (though that being said, I've gone through my recent app downloads, and I don't see anything that raises a red flag or even a yellow one -- if one of the apps that I've downloaded and run lately is compromised, even the developer might not be aware of it). But I'm taking the story itself with a huge grain of salt. At the very least, I think he got hit by a different (yet another) hacker than any of us did.

finnik

Level 1

0 points

Mar 21, 2011 2:35 PM in response to stereocourier

I got charged for two $30 gift certificates "for Richard" while I was in surgery. I don't even know anyone named Richard, and they used an old bank account that only had a little money in it for micro-transactions. That's bounced now...

I reported it to Paypal, reported it to Apple, removed paypal from my itunes billing, changed my password for iTunes...

What else can i do? How likely is it that I will get a refund? How did this happen and why didn't Apple think that maybe two $30 gift certificates is a red flag considering I've never bought them before, and never bought any app for more than $5, EVER?

Why can't I put an authorization required for purchases over $X on my account??

So... what's the chance that i will get my $60 back? =[

trachorn

Level 1

0 points

Mar 22, 2011 8:17 AM in response to arcane93

I just got hacked too. $19.99 for Texas Hold 'em, which depleted my account balance, but didn't actually charge my credit card anything. My credit card information was also removed from the iTunes store. Trying to figure out how to report this to apple, there doesn't seem to be a link in iTunes. I expect I'll find it if I finish reading this thread though. In the meantime, changed my password. Good luck to all.

baggpuss

Level 1

5 points

Mar 22, 2011 1:18 PM in response to trachorn

I had exactly the same thing. Got in contact with the iTunes store support and they were brilliant in getting it resolved. Had the credit back in my account within a couple days, and this was at the weekend.

Seemed to be a Texas Hold'em app that i dont remember downloading, which then proceeded to wipe all buy 79p of my store credit through in app purchases. No idea where it came from, but they were all purchased on the same day.

Mar 23, 2011 5:12 PM in response to stereocourier

Add me now too. I guess I was kinda lucky (?) ... I pulled my CC info months ago from my iTunes account, but I still had $5.02 left in store credit. I got the email invoice on 3/22 on the purchases. I don't even have an iPhone. I rip all my CD's to my iTunes for my iPod, so I'm not to active on the store itself. My last purchase was 9/20/08 for 2 albums for my kids. And being in IT, my security is tighter then a frog's...well you know. So ...why now after all this time of having my account? And how did they get into my iTunes account? Totaly confused to say the least.

Purchases made:
Animations & Emoji From = Fatiger
Symbols From = Fatiger
Memory Test v1.3 From = Fatiger
Bluetooth Share v1.1From = Fatiger
Emoticon v1.0 From = Penbox Mobile

Now my address and info did not change as reported in this thread, but that makes me nervous knowing that someone has my name and addy..?!

Apple's response ..

*Welcome back to iTunes Store customer Support. I am Rumzan again to assist you today.*

*Thank you for submitting the requested information. We verified your account information and reenabled your iTunes account.*

*Please change your account password and security question immediately. Changing the password and security question will help to prevent anyone else from using your iTunes Store account to place orders without your knowledge. You can change your password using this website:*

* https://appleid.apple.com*

*To update your security question, click "Return to My Apple ID" after resetting your password. Then click Manage Your Account, sign in, and choose the "ID and Password" tab. Be sure to enter a security question to which only you would know the answer.*

*To create a strong password and increase your account's security, I highly recommend that you follow the suggestions outlined in the following article:*

*iTunes Store: Best practices for protecting the security of your account*
* http://support.apple.com/kb/HT4156*

*Thank you for using iTunes. Have a Great day!!*

I guess this is just automated...because they didn't answer not 1 of my questions. Well, I'm happy I got my credit back and I changed my password...but now I'm still concerned about the security of iTunes store. And I'm using 10.2.1.1

I hope Apple finds a solution for this. Going forward, there is no way I'm linking my CC or any gift cards to my account anytime soon.

Terrence

Level 1

10 points

Mar 23, 2011 5:33 PM in response to stereocourier

NewsFlash: Apple has released OSX 10.6.7 time to upgrade which should include any fixes in security lapses. If your itunes account is still be broken into, please note inthe thread what OS version you are running. Thanks.

Mar 24, 2011 4:37 AM in response to Terrence

It's a good idea to upgrade, but I can't see how that makes any difference, at least not in my case. There is simply no opportunity for anyone to intercept my login information on this end, and obviously this is a large-scale operation, not somebody's neighbor sniffing out their passwords over an unsecured connection.

ybenner

Level 1

0 points

Mar 25, 2011 9:04 AM in response to finnik

I got got hit with $140 in charges to my paypal account. I'm not sure how my account was even compromised. I had 2 $40 transactions that were an "allowance to XXXX@hotmail.com" and 3 $20 transactions for the same thing. I contacted Paypal and they removed my iTunes agreement. I also removed any payment information from iTunes and changed the password.

I'm not sure how my account was even compromised. The only thing I can think of is that I use my iPhone to buy music sometimes. The other day, I was trying to purchase a song and it prompted me to enter my password as usual, but it also asked me to verify my address. I was in iTunes, nothing third party and it seemed legit...maybe it wasn't? I don't have very many apps on my phone and I haven't downloaded a new one in ages. I've had this account for several years with no issues at all.

Kocha

Level 1

0 points

Mar 26, 2011 4:34 PM in response to stereocourier

It seems like my account just recently hacked as well..

I got charged $59.99 for an in app purchase for Texas Hold'em Poker which I do not have in my iPad or iPhone...

Is there any direct number I can call for support?

On the website, it only stated e-mail, which I have sent.

Mar 26, 2011 5:09 PM in response to bush817

And again! Made a purchase on my iPad(!) and a minute later I had an unauthorized attempt on my card ( I have a special "internet credit card" and there was ony 98c of damage (not much, but my bank told me they do this to test cards...)
A friend of mine the same issue..I will definitely nor use a normal credit card with iTunes or paypal or any of these "super safe internet" dealers. My trust in Apple has dropped significantly looking at this thread. So the question is where is the leak? On the IPad?..well of course I know about the usual blabla password changed, not "1235", wireless password protected etc etc (I have used a computer before!)
So how is this possible?

Mar 28, 2011 9:08 AM in response to stereocourier

Another victim! My itunes was drained of $29.98 on 3/25/11 at midnight for the Orig gangster (very subtle!) app credits. They also changed my billing address city/state to Towson MD. Reported to apple.

arcane93

Level 1

29 points

Mar 28, 2011 10:13 AM in response to stereocourier

Further evidence, as far as I'm concerned, anyway, that this is not a simple matter of a password hack or a virus:

We discovered last night that my girlfriend's account, which she uses on her iPad, has been compromised as well. Fortunately, she didn't have any gift card balance on her account, and from everything that we can tell, all the hackers did was remove her credit card number from the account. We can't find any evidence that any purchases were made.

Here's the thing, though -- she only logs onto that account in the app store, on the iPad itself. To be honest, I don't think that she even knows how to log into it on her computer (and even if she does know how, she never does). The last time that I logged into it on her computer was months ago, when I upgraded the iPad to iOS 4.2 (I've been meaning to upgrade her to 4.3, but haven't gotten around to it). Her password is pretty secure (it's got both uppercase and lowercase letters and numbers, and while it's not totally random, as far as any kind of password generator is concerned it might as well be). All of the apps that she is using are pretty standard -- nothing which raises a red flag as questionable.

So, uh, yeah, it looks extremely unlikely to me that her account could have been compromised on her end. And yet, there it is.

I don't think we're even going to bother to contact Apple about this one, since it appears that all Apple will do is tell her to change her password, and possibly make her go through a runaround with disabling and re-enabling her account. Still, they need to get on top of this now and do something about it.

iTunes store account hacked