Watch Out for This Apple Scam

If you have an Apple device, like an iPhone or a Mac, you almost certainly have an Apple Account. This account is your lifeline: It allows you to connect and sync your data and settings across your various Apple devices. Without it, you could lose access to both these devices and your valuable information.

These accounts are so valuable, in fact, that scammers are now trying to take over yours from afar. Like many scams, this one uses scare tactics to trick you into handing over the keys to your Apple Account, under the guise of official Apple Support. Keep an eye out for this scam, to protect your devices and your data.

Here’s how the scam works: You might notice a series of alerts hit your iPhone, such as multi-factor authentication codes only seen when someone is trying to log into your account. Shortly after all these notifications start to overwhelm your device, you’ll receive a call from “Apple Support.” The representative will sound helpful, asking if they can help with the issue. They’ll even have a real support ticket they can send to the target’s email, which makes the entire situation seem legitimate. Scammers are able to do this by utilizing a flaw that generates a real Apple Support ticket. It’ll come from an official Apple domain, but it is not actually Apple on the other end.

Once you continue to work with the scammer, they’ll send you a link to “reset” your password. Of course, this link will take you to a malicious site posing as an official Apple link. The site will ask for your MFA code, which, when entered, gives the scammers what they need to break into your account. They’ll likely log into your Apple Account on one of their devices, then change the password to lock you out.

How to prevent this scam

It might seem scary to receive a flurry of MFA code requests, but don’t panic. You have MFA enabled, which means that bad actors won’t be able to access your account without accessing your device, or your code. As long as you don’t reveal the code to anyone, your account will remain safe.

But if this is happening, it likely means bad actors have access to your account password. The first thing you should do is to change your password as soon as possible. Once you do, check your connected Apple Account devices: If you see any you don’t recognize, remove them.

Finally, call Apple directly if there are any doubts. Never answer a direct unprompted call from “Apple Support,” as Apple will never call you this way. If you want to confirm whether or not the company has actually opened a support ticket, call them directly and ask.