Apple ID scam texts and emails: how to spot the fake security alert
Quick answer
A text, email or call saying your Apple Account is locked, hacked or has an unauthorized charge is a common scam. Apple says it will never ask for your password or verification code. Don't tap the link or call back: open Settings or apple.com yourself.
- Comes by
- Text, Email, Phone call
- Pretends to be
- Apple
- Last updated
How it works
Scammers pretend to be Apple and tell you something is wrong with your Apple Account (the account people still call an Apple ID): it was broken into, locked, or an Apple Pay charge went through that you didn't make.
The message pushes you to act fast. It might link to a sign-in page that looks like Apple's, or give a phone number to call. Apple's own guidance says scammers can spoof the caller ID so the call appears to come from a real Apple number, and that they often create urgency so you don't stop to think.
What they're after is your Apple Account password and the two-factor code Apple texts you. With both, they can sign in as you. Some callers also ask for card details or try to get you to change security settings, such as adding a new trusted phone number.
Apple says it will never ask you to open a link and sign in, give your password, device passcode or verification code, tap "Allow" so another device can sign in, or turn off two-factor authentication. A caller who says you'll be liable if you hang up is also lying: that line only exists to keep you on the phone.
Red flags
- An unexpected message or call saying your Apple Account was hacked, locked or charged
- A link to sign in, or a number to call, that came with the message
- Anyone asking for your password or a six-digit verification code
- Pressure to act right now, or a claim that you'll be liable if you hang up
- A request to tap "Allow" on your device so another device can sign in
- A call that shows a real Apple number on caller ID: it can be spoofed
Example message
Apple Support: Your Apple Account has been locked because of suspicious activity. Verify your identity within 24 hours or your account will be disabled: [link]. If you did not make this request, call [phone number].
What to do
- 1
Don't tap, reply or call back
Delete the message, or hang up. If you want to check your account, open Settings on your iPhone or go to apple.com in your browser. Don't use a link or number from the message.
- 2
If you gave out your password or a code, change the password now
Change your Apple Account password from Settings, and make sure two-factor authentication is on. Then check Settings for any trusted phone number or device you don't recognize and remove it.
- 3
If you gave card details, call your bank
Use the number on the back of your card. Tell them it was fraud and ask them to block the card and look at recent charges.
- 4
If you let anyone control your device
Turn off the remote-access app, restart, and change the passwords for your email, bank and Apple Account from a device you trust.
- 5
Watch for follow-ups
People who answered once often get more calls. Our guide on what to do after a data breach covers credit freezes and password resets.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers don't need to know you own an iPhone: they send these in bulk. But names, phone numbers and email addresses that show up on people-search sites or in breach lists make a message feel personal, and make it easier to reach you on the right number. Serus finds and removes your listings from data brokers and people-search sites, and alerts you when your email or password shows up in a breach, so fewer scammers can reach you.
More Apple scams
Frequently asked
Is the Apple ID text real if it uses my name?
Not necessarily. A name is easy to buy or look up. Apple says it won't ask you to sign in through a link or share a verification code, so treat any message that does as a scam.
Will Apple ever call me about a hacked account?
Apple says scammers often claim your account was broken into. If a call seems off, hang up and contact Apple yourself using details from apple.com.
What if I already entered my password on the page?
Change your Apple Account password straight away and check that two-factor authentication is on. Then review your trusted devices and phone numbers.
Where do I forward a suspicious email?
Apple lists reportphishing@apple.com for suspicious emails. For scam calls in the US, report to the FTC at reportfraud.ftc.gov.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
