Mac Security · High-Risk Users & Lockdown Mode · Lesson 5 of 5

Challenge: The Threat Notification

Help a journalist friend respond calmly to an Apple threat warning.

The email

Your friend Dana is a reporter who writes about government contracts. She calls you, worried. An email in her inbox says it is an Apple threat notification. It says she may have been targeted by mercenary spyware.

The email looks official. It has the Apple logo and a calm, serious tone. Dana is tempted to click the button at the bottom that says to learn more.

She asks you two things. Is this real? And what should she do first?

You remember that real threat notifications exist, and that people like Dana are the kind of people they go to. You also remember that scammers copy them. You tell her to take a breath and not tap anything yet.

The first job is to find out whether the warning really came from Apple, without trusting the email itself.

Checking it the safe way

Dana types the address herself and signs in. A banner at the top of the page confirms it. Apple did send her a threat notification.

She also notices the email never asked for her password, a code, or an app. That fits what a real one looks like.

Dana uses an iPhone and a MacBook for her work. She wants to close as many doors as she can on both, right away, and she'll contact an expert helpline for advice too.

Living with the changes

Dana turns on Lockdown Mode on both devices and installs all updates. She also contacts the Digital Security Helpline at Access Now for expert help.

The next morning she messages you. Safari shows a Lockdown Mode is on banner, which she expected. But her newspaper's publishing website, the one she uses every day, won't load properly. She types its address herself and confirms it's the real site.

Protecting her account

Dana's last worry is her Apple Account. Attackers who can't break into a device often try to break into the account instead. A fake sign-in page or a phone call could trick her into giving away a six-digit code.

She wants sign-in protection that can't be read out over the phone or typed into a fake site. She also wants a backup plan in case she loses something on a trip.