iOS Internals · Staying Safe on iPhone · Lesson 1 of 5

Scams & Fake Apple Support

Spot fake Apple calls, phishing texts and scary pop-ups, then report them.

The call that isn't from Apple

Most attacks on iPhone owners don't break into the phone at all. They trick the person holding it. This is called social engineering: a scammer pretends to be someone you trust, such as your bank or Apple, so you'll hand over passwords, codes or money. Phishing is the best-known kind, usually a fake email or text with a link to a fake sign-in page.

Three versions show up again and again:

• Fake Apple Support calls. The caller ID may even say Apple, because scammers can fake the number your phone displays. This is called spoofing. The caller says someone broke into your iCloud account or made charges with Apple Pay, and offers to help you stop it.
• Apple Account phishing. A text or email says your account is locked or your iCloud storage is full, with a link to "verify". The page looks like Apple's sign-in screen, but whatever you type goes to the scammer.
• "Your iPhone is infected" pop-ups. While you browse in Safari, a page flashes a virus warning or a prize, often with a phone number to call. Apple says these pop-ups are usually fraudulent ads. Don't call the number or tap the links. Just close the tab.

The scripts follow a pattern. The scammer creates urgency so you don't stop to think. They may mention real details about you, like your address or employer, to seem legitimate. And they steer you away from contacting Apple yourself, perhaps saying you can call Apple, but the fraud will keep going while you do.

Apple is unusually clear about what it will never do. It will never ask you to sign in on a website it points you to, approve a two-factor sign-in prompt for someone, or tell it your password, device passcode or verification code. It will never ask you to turn off a security feature such as two-factor authentication or Stolen Device Protection. And it says never to pay anyone with Apple Gift Cards. If a "support agent" asks for any of these, you've found the scam.

Spot it, report it, filter it

Apple lists signs that an email or text is phishing:

• The sender's address or number doesn't match the company it claims to be.
• It arrived at an email address or number you never gave that company.
• A link looks right, but the web address doesn't match the company's real site. On iPhone, touch and hold a link to preview where it goes without opening it.
• It looks different from that company's usual messages, asks for personal details like a card number or password, or arrives unexpectedly with an attachment.

If you already typed your password into a fake page, Apple's advice is to change your Apple Account password straight away and make sure two-factor authentication is on.

Reporting helps Apple shut scams down. Forward suspicious emails that pretend to be from Apple to reportphishing@apple.com. For a text that pretends to be Apple, take a screenshot and email it to the same address. For a fake FaceTime call, for example one that looks like your bank, email a screenshot of the call details to reportfacetimefraud@apple.com. In the US, scam phone calls can also go to the Federal Trade Commission at reportfraud.ftc.gov.

Inside Messages, a Report Spam link appears under messages from unknown senders (older Apple pages call it Report Junk). Tap it, then Delete and Report Spam. For iMessage, the message and sender details go to Apple and the message is deleted from your phone. For regular texts, depending on your carrier and country, the report may go to your carrier. Reporting doesn't stop that sender, so block them too.

You can also keep strangers out of your main inbox. In current iOS versions, open Messages, tap the filter button, choose Manage Filtering and turn on Screen Unknown Senders (older versions called a similar switch Filter Unknown Senders). Texts from people who aren't in your contacts land in a separate Unknown Senders folder, and you aren't notified. Links don't open and images stay blurred until you mark the sender as known. You can still allow notifications for useful categories, like verification codes.