A new scam involving fake Apple ID recovery messages has been targeting iPhone and other Apple device users. The scam starts with a text message that looks like it is from Apple, warning that a new device has logged into the victim’s iCloud account. It includes a link to a fake website, appleidrecovery.com, and tells the victim to change their password immediately on that site. However, appleidrecovery.com is not an official Apple site and is run by scammers. This article provides an in-depth look at how the AppleIDrecovery scam works and what you can do if you receive the phishing text message or have already fallen victim.
Overview of the AppleIDrecovery Scam
The AppleIDrecovery scam is a form of phishing attack aimed at stealing personal and financial information from Apple device users. It starts with a text message that appears to come from Apple, warning that an unauthorized device has accessed the recipient’s iCloud account.
The message includes a link to a fake website, appleidrecovery.com, and instructs the victim to change their password immediately on that site. However, appleidrecovery.com has nothing to do with Apple and is a scam website run by cybercriminals.
If the recipient clicks on the link and enters any information, they risk having their Apple ID, passwords, and other sensitive data stolen by the scammers. The criminals can then use this information for identity theft, accessing the victim’s online accounts, or making fraudulent purchases on their payment cards linked to their Apple ID.
The AppleIDrecovery scam takes advantage of people’s concerns over account security and trust in the Apple brand. But Apple never sends unsolicited messages asking users to change passwords or sign in on external websites. Any communication appearing to come from Apple but leads to a non-Apple site should be considered extremely suspicious.
Common Traits of the AppleIDrecovery Scam Text
The fake Apple ID recovery text messages have some common characteristics:
- They appear to come from Apple, with the sender ID showing as “Apple” or “Apple Inc.”
- They report a new, unauthorized device accessing the recipient’s iCloud such as “A new device has logged into your iCloud account from Frankfurt, Germany.”
- They provide a link to a site like appleidrecovery.com instead of the real Apple ID site at appleid.apple.com.
- They urge immediate action to change password, threatening loss of account access.
- Text may come from a variety of numbers, often 5- or 10-digit numbers.
- The scam site mirrors Apple’s aesthetics with logos and branding.
- Scam site asks for Apple ID, password, phone number, and other sensitive info.
Goal of the Scammers
The criminals running this scam aim to gather users’ Apple ID details, passwords, and other personal information by posing as Apple. With the stolen credentials, they can:
- Access the victim’s iCloud account to steal personal data, photos, or files.
- Make purchases through Apple services linked to the user’s account and payment information.
- Access the victim’s other online accounts if they reused the Apple ID password elsewhere.
- Take over the email associated with the Apple ID account for further social engineering scams.
- Commit tax fraud or identity theft using the victim’s information.
- Sell the stolen accounts and data on the dark web.
In short, the scammers seek to fully monetize the sensitive information entered on their fake appleidrecovery.com site for financial gain at the victim’s expense.
How the AppleIDrecovery Scam Works
Cybercriminals run the AppleIDrecovery scam using the following process to target and trick Apple device users:
1. Victim Receives Fake Security Alert Text
The scam starts with an SMS text message sent to the victim’s iPhone or other smartphone. The message is made to look like it comes directly from Apple. The sender ID may show “Apple” or “Apple Inc.”
The text conveys a sense of urgency, typically stating that a new device has been logged into the user’s Apple account or iCloud from a faraway location like “Frankfurt, Germany.”
It emphasizes the need for immediate action, instructing the user to change their Apple ID password right away before getting locked out. This raises fear that their account has been compromised.
2. Link Leads to Phishing Site appleidrecovery.com
The text includes a link to change the password, pointing to the fraudulent site appleidrecovery.com instead of the real Apple site. The scam URL is designed to look believably like an Apple-owned recovery site.
If the recipient clicks the link on their phone, it opens the convincing copycat site in the mobile browser. The site displays Apple branding and logos, continuing the deception.
3. Fake Site Requests Apple ID and Password
The scam appleidrecovery.com site presents an account sign-in page mimicking Apple’s aesthetics. To proceed, it asks the user to enter their Apple ID and password, along with a phone number.
If the victim enters their actual Apple credentials, this sensitive information is harvested by the scammers operating the fake site.
4. More Personal Info Captured for Fraud
After capturing the ID and password, the phishing site may present additional forms requesting more of the user’s personal details. This can include full name, date of birth, billing address, phone number, and credit card information.
The scam site claims this extra information is needed to “verify account ownership.” But in reality, it gives the criminals more data to commit identity theft and payment fraud.
5. Criminals Leverage Stolen Data for Financial Gain
With control of the victim’s Apple ID, password, and other personal information, the scammers can now access their accounts and services. This allows them to:
- Break into the user’s iCloud account to steal data, photos, files, and backups.
- Log in to iTunes, the App Store, Apple Music, Apple TV, and more to make fraudulent purchases under the victim’s name using cards on file.
- Access the victim’s email account associated with their Apple ID if iCloud Mail is enabled.
- Leverage the password if reused on other sites to break into additional online accounts.
- Open new lines of credit or file fraudulent tax returns using the stolen identity information.
- Sell the Apple ID, password, and related data on dark web sites.
The scammers extract maximum financial gain through these methods, while leaving the victim to deal with compromised accounts, fraudulent charges, and identity theft fallout.
What to Do if You Received the Apple ID Recovery Scam Text
If you get a suspicious text claiming to be from Apple about a security issue, take the following actions:
Do Not Click Any Links in the Message
If you receive an SMS about unauthorized iCloud access with a phishing link, do not click it under any circumstances. Visiting the scam site risks your sensitive information being collected and used for fraud.
Check the Sender Details
Take a close look at the message sender ID. Note that scammers can spoof the sender field to say “Apple.” But Apple does not send unsolicited password reset or account recovery requests by text.
Go Directly to the Real Apple Site
Open your browser and navigate directly to appleid.apple.com. Sign in to your Apple account there to view recent devices, security alerts, and account activity. Check for any unauthorized access or changes.
Change Your Apple ID Password
Reset your Apple ID password immediately if you suspect a security issue. But only change it directly through appleid.apple.com, not via any text links. Use a strong, unique new password.
Contact Apple Support to Report Scam
Notify Apple Support about any suspicious security alert messages by reaching out directly to https://support.apple.com/contact. Apple can confirm legitimacy and help address account security concerns.
Block the Sender
Block the phone number that sent the Apple ID recovery scam text to prevent more messages. You can typically block numbers right from your iPhone’s Messages app.
Report the Scam Text
Report scam texts to help identify and shut down active phishing campaigns. You can report SMS scams directly to your mobile provider, the FTC’s spam reporting site, and Apple.
Beware of Any Further Suspicious Contact
Be cautious of any further unsolicited communications related to your Apple account, whether by text, email or phone call. Cybercriminals often follow up with additional scam attempts after collecting potential target phone numbers. Avoid clicking links or providing information to any unverified outreach. Remain vigilant against fraud.
What to Do if You Entered Information on appleidrecovery.com
If you received the scam iCloud phishing text and ended up inputting your Apple ID, password or other info on appleidrecovery.com, take these steps to secure your accounts:
Immediately Change Apple ID Password
If you entered your real password on the fake site, change your Apple ID password right away. Reset it to a new, strong password through appleid.apple.com. This blocks the scammers from your account if they captured your old password.
Enable Two-Factor Authentication
Add extra security to your Apple ID by turning on two-step verification under account settings. This requires you to enter a code from a trusted device when signing in, preventing unauthorized access.
Check Linked Credit/Debit Cards
Inspect any payment cards you have associated with your Apple ID account for fraudulent charges. Contact your bank or card issuer to report any suspected unauthorized transactions.
Cancel Subscriptions/Services
Log in to your Apple account and visit settings to see what subscriptions or services like Apple Music you may have. Cancel any you do not recognize to prevent ongoing fraudulent charges.
Watch for Suspicious Account Activity
Frequently check your Apple account settings, device lists, and linked app activity over the next weeks to spot any suspicious changes indicating compromise. Report anything abnormal to Apple.
Run Antivirus Software
Download and run a full antivirus scan on any computers where you accessed the scam site. Check for any malicious programs that may have infected your devices during the phishing attempt.
Reset iCloud Account
If you believe your iCloud may have been compromised, reset your account through Apple support. This restores account security by revoking access from linked devices and generating new secure credentials.
Contact Banks/Other Accounts
If you reuse the same password across multiple accounts, contact all of those providers. Reset passwords and enable extra security protections to prevent the scammers from accessing additional accounts with your stolen credentials.
Review Credit Reports
Check your credit reports at AnnualCreditReport.com to identify any suspicious accounts or activities opened in your name stemming from an Apple ID compromise. Report any fraudulent accounts or transactions.
Taking quick action to secure your accounts and data can help limit the damage from any information lost in the phishing scam. But remain vigilant for signs of further misuse of your credentials by cybercriminals in the future.
The Bottom Line
The AppleIDrecovery scam is a deceptive phishing campaign that sends fake iCloud security alerts by text to trick users into revealing Apple ID account credentials. The text includes a link to the fraudulent site appleidrecovery.com impersonating an Apple password recovery page. This results in account compromise and potential financial fraud if victims enter any data.
If you receive a suspicious text claiming to be from Apple requiring a password change, ignore it. Instead go directly to appleid.apple.com to manage your account and security. And never enter Apple credentials into any site outside Apple’s official online platforms. Learning to spot and avoid the Apple ID scam can protect you from losing sensitive personal data or money.
