Phishing SMS/text sent through APPLE

Question

Level 1

12 points

Phishing SMS/text sent through APPLE

Hey all.

Just thought I'd bring this to your attention.

My iPhone 6S was stolen two weeks ago, and upon recovering my iCloud account this week I found multiple emails claiming my iPhone was found and that I should 'validate' my account as soon as possible. The link was to a non-Apple site, and I did not fall for this phishing scam.

I reported the fraud to Apple Support today, and minutes after my call I receive a text from Apple (yes, Apple! the same Apple SMS line where I receive my verification codes for logging into iCloud) saying that again, my iPhone has been found and that I should view the location of my device at a bogus-looking domain, and the SMS claims to be from Apple Support with a provided number given.

While I highly doubt that I will get my iPhone 6S back, I'm just shocked at how the hackers were able to get through to Apple's SMS services and send me that text 😮 Reported the SMS to Apple too, and sent a screenshot.

My Apple ID is still tied to my iPhone 6S, but I have no idea how the thieves were able to get access to my Apple ID without my passcode and the two-factor authentication (unless they bypassed this without my password!?).

iPhone 6s, iOS 10

Posted on Oct 19, 2016 8:24 PM

Reply

Answer 1

zinacef

Level 10

88,810 points

Oct 19, 2016 8:27 PM in response to fishhhcake

You might want to follow the instructions provided here -- If you think your Apple ID has been compromised - Apple Support

http://www.apple.com/legal/more-resources/phishing/

Reply

Answer 2

fishhhcake Author

Level 1

12 points

Oct 19, 2016 8:36 PM in response to zinacef

Thanks! I already did a password reset and Apple Support claims the two-factor authentication protects my account from being compromised. But I still don't know how the thieves were able to send an email to my Apple ID. :/

Reply

Answer 3

zinacef

Level 10

88,810 points

Oct 19, 2016 8:38 PM in response to fishhhcake

I'm finding it kind of hard to believe, with two-step (not "factor") verification in place, that the thieves were still able to break into your account, because with 2SV, they will need to have one of these -- password, verification code, and/or recovery key.

Frequently asked questions about two-step verification for Apple ID - Apple Support

Reply

Answer 4

LACAllen

Level 8

43,590 points

Oct 19, 2016 8:57 PM in response to fishhhcake

Anyone with your phone number can send you an SMS. They don't need anything from Apple.

Apple does not send notifications when you phone has been found. By any means.

You and you alone mange the "Find My Phone " portion of "Find My Phone". Apple does not proactively look for lost or stolen devices.

Apple does not have a "validate" your account process. Those emails were bogus.

It seems you have a new phone. Does it have the same number as before?

People report these emails and SMSs daily. Most have never lost a phone at all.

Reply

Answer 5

fishhhcake Author

Level 1

12 points

Oct 19, 2016 9:14 PM in response to LACAllen

Changed my mobile number. The SMS was sent as from 'Apple' to the number I provided in the 'Lost my iPhone' custom message. Reported both emails and SMS to Apple.

When I mean sent from 'Apple,' it was sent from the same 'Apple' which provides me the verification codes for logging on to iCloud. That's what I find scary.

Reply

Answer 6

fishhhcake Author

Level 1

12 points

Oct 19, 2016 9:17 PM in response to zinacef

Maybe they weren't able to break into my account since they keep trying to phish for my account password. But what I don't know is how they were able to get my Apple ID to send me those emails in the first place.

And my bad, two-step verification 🙂

Reply

Answer 7

LACAllen

Level 8

43,590 points

Oct 19, 2016 9:17 PM in response to fishhhcake

Changed my mobile number. The SMS was sent as from 'Apple' to the number I provided in the 'Lost my iPhone' custom message. Reported both emails and SMS to Apple.

Then that would be from the "custodian" of your phone I would guess. They know they can't get past activation lock and are attempting to phish the password from you.

I still wouldn't think the code is genuine either. Did you make your new phone a trusted device for that Apple ID already? If not, Apple would have no "path" to get you codes yet.

Reply

Answer 8

fishhhcake Author

Level 1

12 points

Oct 19, 2016 9:26 PM in response to LACAllen

Yes, my new phone (dual sim, both new numbers) is already a 'trusted device' for my Apple ID after I recovered my Apple ID. Changed my trusted mobile number to a new number, then changed it again after I used the first new number as a contact number for the 'Lost my iPhone' custom message.

'Apple' sent the 'iPhone found' SMS to my first new number. It is no longer associated with my Apple ID, but is still on the custom message for my iPhone on Lost Mode.

And yes, I have been receiving legitimate verification codes on the new numbers (the first when it was still my trusted number but not anymore), or else I wouldn't go beyond the two-step verification of iCloud 🙂

Reply

Answer 9

LACAllen

Level 8

43,590 points

Oct 19, 2016 9:27 PM in response to fishhhcake

'Apple' sent the 'iPhone found' SMS to my first new number. It is no longer associated with my Apple ID, but is still on the custom message for my iPhone on Lost Mode.

If you wish to believe that, I am done trying to help you.

Best of luck to you.

Reply

Answer 10

fishhhcake Author

Level 1

12 points

Oct 19, 2016 9:29 PM in response to LACAllen

I don't believe that it is Apple sending it that's why I reported it to Apple Support.
How were the hackers able to send me an SMS from 'Apple' yes it is the same Apple sending me verification codes which I use to be able log in to my iCloud now.

Anyway, I hope you get what I'm trying to explain. But still, thanks for the help.

Reply

Answer 11

LACAllen

Level 8

43,590 points

Oct 19, 2016 9:35 PM in response to fishhhcake

I have twice already explained what I believe is happening.

Bad guys have your phone, YOU gave them a number, via Lost Mode, to contact you with. They have done exactly that, pretending to be Apple.

There is is little you can do now. Without your current password, they can't use your phone and they know this. This is why they are making the effort to phish that password from you.

You want to know how & why and I believe I've told you.

Reply

Answer 12

Camelot

Level 9

58,881 points

Oct 19, 2016 9:39 PM in response to fishhhcake

How were the hackers able to send me an SMS from 'Apple'

It's pretty trivial to send an SMS from any number you like. About as easy as spoofing CallerID on a voice call, and only marginally harder than spoofing an email address (did the president@whitehouse.gov really just send you an email?)

Reply