Is this email a scam?

Question

Is this email a scam?

Hi All,

I just received the following email. It looks pretty official, but I've made no purchase recently on this account, and the account actually has not really been active for years:

_____________

From: Apple<no_reply@email.apple.com>

Date: Sat, Apr 7, 2018 at 2:09 PM

Subject: Your recent purchase with your Apple ID.

To: [my email address]

Dear [My actual first name],

Your Apple ID, [my email address], was just used to purchase Heads Up! from the App Store on a computer or device that had not previously been associated with that Apple ID. You may also be receiving this email if you reset your password since your last purchase.

If you made this purchase, or have reset your Apple ID password since your last purchase, you can disregard this email.

If you did not make this purchase, or believe someone may have accessed your account, go to (https://appleid.apple.com) and change your password as soon as possible.

Regards,
Apple

__________

When I hover over the link, the link points to the apple address (https://appleid.apple.com) that it gives in the email, but still... I find this all very suspicious.

Thanks in advance!

Posted on Apr 7, 2018 8:00 AM

Reply

Answer 1

turingtest2

Level 10

278,039 points

Apr 7, 2018 8:04 AM in response to timothystutters

Review recent purchases at https://reportaproblem.apple.com/ or check your purchase history in iTunes and view your subscriptions. If you are the organizer of a family share check for purchases by other members.

See also If you see an unfamiliar iTunes Store or App Store charge on your bank, credit card, or debit statement - Apple Support and About payment card authorization holds in the iTunes Store - Apple Support.

If you cannot identify the payment then perhaps you are looking at a phishing email.

If there really have been purchases that you didn't authorize, or you've entered your Apple ID credentials at a fake Apple portal, see If you think your Apple ID has been compromised - Apple Support, change your Apple ID password, and if possible turn on Two-factor authentication for Apple ID - Apple Support.

See also Use Restrictions to prevent purchasing on your iPhone, iPad, or iPod touch - Apple Support.

If there is no evidence of a charge on either your iTunes or bank/credit card accounts this is likely to be a phishing exercise which you should ignore.
If there is a charge shown under your iTunes store account and it relates to misuse of your Apple ID then you need to start a conversation with iTunes Store support to get it cancelled and refunded, change your password, and enable two-factor authentication if at all possible.
If it isn't connected to your own Apple ID but funds have gone from your bank or credit card account that purport to be from iTunes then the account has been compromised and you need to deal directly with your financial institution.

tt2

Reply

Answer 2

Niel

Community+ 2025

Level 10

741,083 points

Apr 7, 2018 10:33 AM in response to timothystutters

There's one U2 album from 2014 under "family purchases"

Apple added the Songs of Innocence album to everyone's account. This isn’t related to your issue.

But I still don't seem to have permission to manage the family settings.

Click here or here and contact Apple.

(159412)

Reply

Answer 3

turingtest2

Level 10

278,039 points

Apr 7, 2018 10:46 AM in response to timothystutters

Apple gave the U2 album to everyone whether they wanted it or not. See SOI Removal for details.

See Leave Family Sharing - Apple Support for details on how you're supposed be able to withdraw from or disband a family sharing group if you're supposed to be the organizer.

See If you think your Apple ID has been compromised - Apple Support for advice on taking back full of the account or closing it properly.

tt2

Reply

Answer 4

Niel

Community+ 2025

Level 10

741,083 points

Apr 7, 2018 8:03 AM in response to timothystutters

Click here and check for that account, including hidden ones.

(159410)

Reply

Answer 5

Apr 7, 2018 8:27 AM in response to turingtest2

Thanks for the responses. Fortunately, (and strangely enough) this was an old account, and I have a new account with my new Mac. I haven't thought about this old Apple account in years, and the credit card on it expired two years ago. Thus, it's kind of impossible that someone could have purchased something on the account. I just logged in, and there was an iPhone x listed on the account as an "administrator" -- which is very strange, as I have never in my life owned an iPhone. Probably the account was compromised somehow at some point, and this was a phishing scam attempting to get my login info, or maybe an up to date credit card.

Reply

Answer 6

turingtest2

Level 10

278,039 points

Apr 7, 2018 9:05 AM in response to timothystutters

Looks that way. Did you check the account's purchases? As Niel mentioned they could have hidden anything obtained with the account, assuming the email really came from Apple as a result of that activity.

tt2

Reply

Answer 7

Apr 7, 2018 9:22 AM in response to turingtest2

Now it actually looks like the email is on the up-and-up and someone has hacked the old account. When I log in through iTunes and look at my account purchases, there are a slew of pending purchases for Chinese apps from today, and my iTunes account says, of course, that the payment method is not valid, as the only card on the account hasn't been valid since 2015 or 2016.

At some point it looks like someone hacked the account and set up "family settings" on it. They haven't used it much. There's one U2 album from 2014 under "family purchases" (definitely not me - U2's really not my thing) and two users with Chinese names listed.

Unfortunately, now when I go to iCloud, my "set up family" button is greyed out. So I don't know how to fix this. I guess I'd like to either regain complete control of the account or delete it entirely if that's no longer possible.

Reply

Answer 8

Apr 7, 2018 9:38 AM in response to timothystutters

(ps) I've already changed the password, deleted the iPhone and set up two-step authentication, of course. But I still don't seem to have permission to manage the family settings.

Reply

Is this email a scam?

Similar questions