Phishing Apple Accounts from appleid@id.apple.com

Question

Level 1

5 points

Phishing Apple Accounts from appleid@id.apple.com

Watch out. Got this obvious phishing scam today trying to access my apple account. What worries me is that they had the AppleID correct. This came from Apple <appleid@id.apple.com>

Dear ,

You've entered xxxxxxxx8@yahoo.com as the contact email address for your Apple ID. To complete the process, we just need to verify that this email address belongs to you. Simply click the link below and sign in using your Apple ID and password.

Verify Now >

Wondering why you got this email?
It's sent when someone adds or changes a contact email address for an Apple ID account. If you didn't do this, don't worry. Your email address cannot be used as a contact address for an Apple ID without your verification.

For more information, see our frequently asked questions.

Thanks,
Apple Customer Support

Macbook, Mac OS X (10.4.8)

Posted on Jan 15, 2011 12:01 AM

Reply

Answer 1

Jan 15, 2011 3:30 AM in response to patrickjd78

Had you just altered your account in some way?

Reply

Answer 2

etresoft

Level 8

46,056 points

Jan 15, 2011 5:47 AM in response to patrickjd78

Where does that link take you? If you hover over it with your mouse in Apple Mail, it will show you what the link is. If it isn't apple.com/something, don't click it.

Reply

Answer 3

patrickjd78 Author

Level 1

5 points

Jan 15, 2011 1:24 PM in response to etresoft

No I had not altered my account, No I did not follow the link, but this is not apple.com. I did open a new window, went to apple and searched on the email address and came up with nothing, so I'm sure it is not a valid Apple address.

Reply

Answer 4

Jan 15, 2011 1:52 PM in response to patrickjd78

Hi,

Did it look like this:-

This is a email regarding a Face Time Registration.

Mousing over the Verify link give a long list of characters that are specific to you (along with a non Apple looking URL lead in bit)

The FAQ bit leads here http://www.apple.com/support/appleid/

(I popped in after seeing a request from another Level 4 poster and a suggestion from yet another in response to that).

EDIT
P.S. I also have the Header info if you need it which list the Apple Server it originated at.
The Number in the tooltip bit also appears in the Header info under "X-Ds-Vetting-Token: "

9:47 PM Saturday; January 15, 2011

Reply

Answer 5

etresoft

Level 8

46,056 points

Jan 15, 2011 2:05 PM in response to Ralph-Johns-UK

You can never tell by how an e-mail "looks". That can be, and has been, easily faked. You just hover your mouse over the link and look at the URL. Even legitimate URLS with have a long, practically indecipherable query string. Just look at the start of the URL and make sure it ends in "apple.com" and not something like "apple-com.cn" or just an IP address like "12.13.14.16"

Reply

Answer 6

Jan 15, 2011 2:19 PM in response to etresoft

Granted.

Maybe I could have been clearer about my pic being of my Verification Email about Face Time.

I did come back and add info about the Header info including matching the Verification Number and the issuing server (which lists an IP).
Whilst some of that info can be spoofed in to the Header info, comparison may well aid someone in checking.

As was suggested in the thread that led me here, the Topic of Face Time Registration had not been raised here yet, and maybe an aid to memory by mentioning it.

10:19 PM Saturday; January 15, 2011

Reply

Answer 7

FloHHW

Level 1

0 points

Aug 30, 2011 7:58 AM in response to patrickjd78

This is what I've received TWICE right after I ordered someting in the appstore on my iphone:

Is this phishing or truly from Apple?

Reply

Answer 8

Chris CA

Level 10

82,434 points

Aug 30, 2011 10:16 AM in response to FloHHW

See this -> http://support.apple.com/kb/ht2075

reportphishing@apple.com

Reply

Answer 9

tericee

Level 1

9 points

Dec 26, 2011 5:49 PM in response to patrickjd78

Did anybody ever answer this?

Reply

Answer 10

Chris CA

Level 10

82,434 points

Dec 26, 2011 6:38 PM in response to tericee

"Did anybody ever answer this?"

Yes.

Reply

Answer 11

Mar 5, 2012 2:20 AM in response to patrickjd78

If you want to be safe you can go to https://appleid.apple.com/ and click on "manage your account". This then confirmed that an email had been sent and also allowed me to resend it. When the email arrived in my inbox 10 seconds later I was pretty convinced it was genuine. Hope that helps.

Reply

Answer 12

Chris CA

Level 10

82,434 points

Mar 5, 2012 7:26 AM in response to jlwilson11

jlwilson11 wrote:

If you want to be safe you can go to https://appleid.apple.com/ and click on "manage your account". This then confirmed that an email had been sent and also allowed me to resend it. When the email arrived in my inbox 10 seconds later I was pretty convinced it was genuine. Hope that helps.

I went there and didn't see anything about an email being sent and nothing about allowing me to resend an email.

How about posting exactly what you did?

Reply