Apple ID Scam Attempt

[SteveJUAE]

I got what appears an legitimate email warning from Apple noting that an IPhone6 had logged on to my iMessage (see below 1st email)

Which is a bit odd as I do not have Imessage and on checking my account nothing could be seen, also checking the links and header etc of the email it all seem legit, of course I changed my account info for peace of mind even though I do not believe it was compromised

However today I got a follow up message saying my Apple ID had been used for a purchase, which is not possible for many reasons, other than using my email address.

It's clear the 2nd email (see below 2nd email) is the real phishing one with odd links and poor English but what I was surprised at or believe if someone attempts even if unsuccessful to logon Apple seem to send the alert thus allowing the Phisher some leverage in catching out the now suspicions owner of the ID

Is my assumption correct and Apple will send an alert if someone just try's but unsuccessful to logon to your account etc ? else the 1st email is much smarter than I thought as it's identical to one I made by logging on with a different device


1st email from Apple <noreply@email.apple.com>

Dear *********************,

Your Apple ID (***********) was used to sign in to iMessage on an iPhone 6 named “iPhone”.

Date and Time: March 31, 2017, 4:14 AM PDT

Operating System: iOS 8.3

If the information above looks familiar, you can disregard this email.

If you have not recently signed in to an iPhone 6 with your Apple ID and believe someone may have accessed your account, go to Apple ID (https://appleid.apple.com) and change your password as soon as possible.

Apple Support



2nd email from Apps Store <ualg@qoc.com>


Dear *************,

Your Apple ID Was Just Used To BUY ******** $19.99 From The App Store on A Computer or Device That Had Not Previously Been Associated With That Apple ID.

This Purchase Was Initiated From USA.


If You Did Not Make This Purchase, Enter Here (link removed) To Cancel This Order And Confirm Your Apple ID .


If You Make This Purchase, You Can Disregard This Email

Thank You
Apple Customer Support





Copyright 2016 Apple Inc. Apple Inc. All rights reserved. | Terms of Use | Privacy Policy | Sales Policy

 

[JackieInCo]

I'm not sure if Apple will send an email saying someone tried logging in but failed.

Several years ago, I did get an email from Apple saying my email address was used to create an iTunes account. I was able to use the forgotten password to change the password and login to this account that someone created. I was able to see their billing info/address and phone number. I still think they simply typed their email address wrong. I simply deleted all their info and set the billing to none. I have not used that iTunes account in all these years.

 

[Possumgal]

Did the second Apple e-mail come after you had changed your ID? What looks fishy to me is the part that asks you to click on a link and confirm your Apple ID. It may be a phishing scam. I'd suggest checking with the App Store to see if such a purchase was actually made. Many "phishers" will scare people into thinking some bogus amount has been charged to some account of theirs and get them to click on a link without thinking. I've gotten some like that in the past, supposedly from FedEx, UPS and Amazon.

 

[SteveJUAE]

Did the second Apple e-mail come after you had changed your ID? What looks fishy to me is the part that asks you to click on a link and confirm your Apple ID. It may be a phishing scam. I'd suggest checking with the App Store to see if such a purchase was actually made. Many "phishers" will scare people into thinking some bogus amount has been charged to some account of theirs and get them to click on a link without thinking. I've gotten some like that in the past, supposedly from FedEx, UPS and Amazon.

Your have it right its the 2nd email that's the scam (I disabled the link in my posting above) as they tried to scare you with the first, but what I cannot resolve is the 1st email it looks 100% genuine I don't believe they actually managed to logon to my account but somehow they managed to trip Apples email alert system to add credence to their 2nd email

 

[576316]

I get a LOT of fraud/spam email to my general account - it must have been sold somewhere down the line. But recently I got one of these Apple ones too. It said my account had been logged into from France, but checking the actual email address it was sent from confirmed it didn't come from Apple.

Best thing to do here is to forward the email to abuse@icloud.com

That sends it directly to Apple so they can investigate and at least attempt to block the sender.

 

[SteveJUAE]

I get a LOT of fraud/spam email to my general account - it must have been sold somewhere down the line. But recently I got one of these Apple ones too. It said my account had been logged into from France, but checking the actual email address it was sent from confirmed it didn't come from Apple.

Best thing to do here is to forward the email to abuse@icloud.com

That sends it directly to Apple so they can investigate and at least attempt to block the sender.

Thanks, I got a 3rd email obviously a scam from the links saying I changed my rescue details click here to confirm etc