You get a text saying your Apple Account is locked, or a box fills your browser, saying the Mac you’re on is infected and lists a number to call. In both cases, the messages obviously want you to act before you think.
Neither one of those comes from Apple. Each is the opening move of a fake Apple security alert scam, and it works the same in every region, whether that’s Cardiff or Caernarfon. What the criminals want is your login information, which allows them to access iCloud, saved passcodes, payment cards, and years of photos.
How the scam runs
The details change slightly, but the order doesn’t usually. A message claims there is suspicious activity, a locked account or a payment you never made, and it points to a link or a phone number. The link opens a copy of Apple’s sign-in page. The number reaches someone posing as Apple Support. Either way, the Apple ID scam moves toward the same thing: your password and the verification code that gets sent to your phone. With both, the account can be easily reset within minutes and the real owner shut out.
Phone versions of those Apple scams add another thing. Caller ID can be faked, so a call that shows Apple’s name on the screen doesn’t prove anything at all. Some callers also ask people to install remote-access software so they can allegedly fix the problem, which hands them control of the computer.
A fake Apple security pop-up in your browser is another thing, where the page fills the screen with a virus warning and a helpline number. It is an advert. Apple’s guidance is to ignore it completely and not ring the number or follow through with the link.
Apple security alert: real or fake?
Does Apple send security alerts? Yes, it does, in fact, but only a few kinds. One is an email when your account signs in on a new device, and it is a notice rather than a request. If the device is yours, then there’s nothing to do.
The other is the Apple spyware warning, which Apple calls a threat notification. These go out only when Apple detects an attack aimed at one specific person. Apple says the targets are often journalists, activists, politicians, and diplomats, and that most users will never actually receive one.
Apple’s support page on notifications says a true Apple spyware warning shows up on the iPhone Lock Screen and also in Settings, arrives by email, and appears as a banner at the top of your Account page after you sign in. It also says these notifications never ask you to click on a link or open a file.
That makes the test you need to conduct rather short. An alert that wants you to click, a phone call, or a code is typically fake. If you’re not so sure, ignore the message and type account.apple.com into your browser. Apple will also never tell you to switch off any authentication from your settings, or to tap Accept on a sign-in prompt.
If you already clicked or called
If you’ve fallen for an Apple security alert scam, change the password straight away and check that two-factor authentication is on. Then, go through your signed-in devices, the recovery details, and recent purchases for anything that is out of place. If card details went in, phone the card provider. If someone was given remote access to a computer, take it offline and remove the software.
It’s also good to forward such scam emails to [email protected], and a screenshot of a scam text can go to that same address. You can also always report to the police on 101.
