Scams & Phishing News Apple Pay Users Targeted by Phishing Attack Aimed at Stealing Payment Details

[Brownie2019]

Content source

https://gbhackers.com/apple-pay-users-targeted-by-phishing-attack/

A sophisticated new phishing campaign is targeting Apple Pay users, leveraging high-quality email design and social engineering to bypass security measures.

Unlike typical scams that rely on poorly spelled emails and suspicious links, this campaign uses a “hybrid” approach involving both email and phone fraud, often called “vishing”, to steal Apple IDs and payment data.

Phishing Attack
The attack begins with an email that appears authentic. It features official Apple branding, correct formatting, and a professional layout.

Full Story:

Apple Pay Users Targeted by Phishing Attack Aimed at Stealing Payment Details

A sophisticated new phishing campaign is targeting Apple Pay users, leveraging high-quality email design and social engineering to bypass security measures.

gbhackers.com

 

[Bot]

Full Story:

Apple Pay Users Targeted by Phishing Attack Aimed at Stealing Payment Details

A sophisticated new phishing campaign is targeting Apple Pay users, leveraging high-quality email design and social engineering to bypass security measures.

gbhackers.com

This campaign is a good example of “email-to-phone” phishing (vishing) that tries to bypass people’s normal defenses by avoiding clickable links and pushing you into a fake “Apple Support / Billing & Fraud Prevention” call flow. ([gbhackers.com](https://gbhackers.com/apple-pay-users-targeted-by-phishing-attack/))

What’s actually happening (why it works) ([gbhackers.com](https://gbhackers.com/apple-pay-users-targeted-by-phishing-attack/))

• You receive a realistic-looking “Apple Pay fraud/blocked transaction” email (sometimes even claiming an “appointment” was scheduled). ([gbhackers.com](https://gbhackers.com/apple-pay-users-targeted-by-phishing-attack/))
• The email tells you to call a phone number (not click a link). ([gbhackers.com](https://gbhackers.com/apple-pay-users-targeted-by-phishing-attack/))
• On the call, the scammer attempts a real Apple Account login, which triggers a legitimate 2FA code to your device, then pressures you to read it out “to stop the fraud.” If you share it, you’re effectively authorizing their login. ([gbhackers.com](https://gbhackers.com/apple-pay-users-targeted-by-phishing-attack/))

Practical defenses (the “rules” that stop this cold) ([support.apple.com](https://support.apple.com/en-lamr/102568?utm_source=openai))

• Do not call phone numbers provided in unsolicited emails/texts. If you want to verify, go to Apple’s official support channels independently (Apple Support app / Apple Support site) and contact them from there. ([support.apple.com](https://support.apple.com/en-lamr/102568?utm_source=openai))
• Never share Apple Account verification codes (2FA), passwords, or security codes with anyone—especially on an inbound call. Apple explicitly warns they won’t ask for these. ([support.apple.com](https://support.apple.com/en-lamr/102568?utm_source=openai))
• If you’re worried about a charge, verify it directly in your Apple Account / Wallet / bank app—don’t rely on the message. ([appleinsider.com](https://appleinsider.com/articles/26/02/03/apple-users-are-being-targeted-by-a-coordinated-apple-pay-phishing-campaign?utm_source=openai))
• Report the phish to Apple: forward the message to reportphishing@apple.com, then delete it. ([support.apple.com](https://support.apple.com/en-lamr/102568?utm_source=openai))

If someone already called / shared a code ([support.apple.com](https://support.apple.com/en-us/111756?utm_source=openai))

• Change your Apple Account password immediately and review account security/device sign-ins.
• Contact your bank/card issuer to dispute/stop unauthorized charges and monitor transactions.
• Treat any unexpected 2FA prompts as a sign someone is actively trying to access the account—deny and secure the account right away.

Bottom line: the “tell” is the request to call a number + disclose a 2FA code; once you refuse that and verify only through official channels you initiate yourself, this scam collapses. ([support.apple.com](https://support.apple.com/en-lamr/102568?utm_source=openai))

Sources

• Apple Pay Users Targeted by Phishing Attack Aimed at Stealing Payment Details
• Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support
• Get help with security issues - Apple Support
• Apple users are being targeted by a coordinated Apple Pay phishing campaign
• https://cybernews.com/security/apple-pay-phishing-scam-2fa-bypass-malwarebytes-warning/

 

[Divergent]

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1566 (Phishing)
Delivery via email appearing as legitimate Apple correspondence.

T1598.003 (Phishing for Information: Spearphishing Service) Directing users to a malicious call center.

T1626 (Multi-Factor Authentication Request Generation) Attackers trigger a legitimate login attempt, causing Apple to send a 2FA code to the victim.

T1204.001 (User Execution: Malicious Link) Variation: User execution via phone call.

Campaign Profile

Tactical Focus
Social Engineering / Real-time 2FA Interception.

Targeting
Apple Pay users; specifically exploiting anxiety over financial loss.

Telemetry & Indicators of Compromise (IOCs)

Lure Subject Strings

"2025 MacBook Air M4 ($1,157.07)"

"Apple Gift Card purchase for $279.99"

"APPLE STORE – CA"

Behavioral Marker
Emails explicitly instruct users not to click a link but to call a support number for "Billing & Fraud Prevention".

Observed Tactic
The attacker initiates a password reset or login attempt during the call, prompting the user to read back the OTP (One-Time Password) sent to their device.

Remediation - THE ENTERPRISE TRACK (NIST CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Issue an organization-wide alert regarding "Callback Phishing" or "Hybrid Vishing." Explicitly state that Apple Support will never ask for 2FA codes over the phone.

Command
Review "Shadow IT" policies regarding the use of personal Apple IDs on corporate devices.

DETECT (DE) – Monitoring & Analysis

Command
Configure email gateways to flag inbound emails containing high-value transaction amounts (e.g., "$1,157.07") or keywords "Billing & Fraud Prevention" originating from non-Apple domains.

Command
Monitor for unusual volume of traffic to appleid.apple.com if SSL inspection is enabled (though this is legitimate traffic, spikes may indicate targeted users).

RESPOND (RS) – Mitigation & Containment

Command
If a user reportedly shared a code, treat the account as fully compromised. Immediately revoke existing sessions.

Command
Isolate any device associated with the compromised Apple ID from the corporate network until the account is secured.

RECOVER (RC) – Restoration & Trust

Command
Assist user in reclaiming the Apple ID via official recovery channels.

Command
Validate no unauthorized devices were added to the Apple ID trusted list.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Conduct simulated vishing training. Employees must understand that "support agents" requesting OTPs is a definitive sign of attack.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Hang up immediately. Do not speak to the "agent."

Command
Do not read the code. Legitimate Apple support will never ask for your 2FA code, password, or SMS code.

Priority 2: Identity

Command
Log in to appleid.apple.com independently (do not use links from the email). Check for unrecognized devices under "Devices" and remove them.

Command
Change your Apple ID password immediately.

Priority 3: Financial

Command
Open your Apple Wallet or banking app directly to verify if the transaction actually exists. (It likely does not) .

Command
Contact your bank if you provided card details during the call.

Hardening & References

Baseline
Never trust "Urgency" or "Blocked Transaction" notices delivered via email. Verify via the official app.

Framework
NIST SP 800-61r3 (Incident Handling) / MITRE ATT&CK (Phishing).

Reference
This campaign leverages high-quality email design and social engineering to bypass technical security controls.

Sources

GBHackers Security

Cybernews

AppleInsider