{"id":93346,"date":"2018-12-21T11:00:39","date_gmt":"2018-12-21T19:00:39","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=93346"},"modified":"2025-08-13T00:22:23","modified_gmt":"2025-08-13T07:22:23","slug":"apple-phishing-scam","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/privacy-identity-protection\/apple-phishing-scam\/","title":{"rendered":"Cybercriminals Disguised as Apple Are After Users\u2019 Personal Data"},"content":{"rendered":"

With the holidays rapidly approaching, many consumers are receiving order confirmation emails updating them on their online purchases for friends and family. What they don\u2019t expect to see is an email that appears to be a purchase confirmation from the Apple App Store containing a PDF attachment of a receipt for a $30 app.\u00a0This is actually a\u00a0stealthy phishing email<\/a>, which\u00a0has been circulating the internet, prompting users to click on a link if the transaction was unauthorized.<\/p>\n

\"\"<\/p>\n

So how exactly does this phishing campaign<\/a>\u00a0work? In this case, the cybercriminals rely on the victim to be thrown off by the email stating that they purchased an app when they know that they didn\u2019t. When the user clicks on the link in the receipt stating that the transaction was unauthorized, they are redirected to a page that looks almost identical to Apple\u2019s legitimate Apple Account management portal. The user is prompted to enter their login credentials, only to receive a message claiming that their account has been locked for security reasons. If the user attempts to unlock their account, they are directed to a page prompting them to fill out personal details including their name, date of birth, and social security number for \u201caccount verification.\u201d<\/p>\n

Once the victim enters their personal and financial information, they are directed to a temporary page stating that they have been logged out to restore access to their account. The user is then directed to the legitimate Apple ID account management site, stating “this session was timed out for your security,\u201d which only helps this attack seem extra convincing. The victim is led to believe that this process was completely normal, while the cybercriminals now have enough information to perform complete identity theft.<\/p>\n

How to Protect Yourself From Phishing Scams<\/h2>\n

Although this attack does have some sneaky behaviors, there are a number of steps users can take to protect themselves from phishing scams like this one:<\/p>\n