New in OS X: Get MacRumors Push Notifications on your Mac

Resubscribe Now Close

Apple Phishing Scams Growing More Advanced, With Latest Spoofing Apple Phone Numbers

Phishing scams attempting to get info out of Apple users are nothing new, but scammers are growing more clever and scams are getting harder to distinguish from actual Apple communication.

On his Krebs on Security site, security researcher Brian Krebs today outlined one of the latest phishing scams he's seen, where an incoming phone call appears to be from a legitimate Apple support line.

As described by Krebs, Jody Westby, CEO of security consulting firm Global Cyber Risk, received an automated call on her iPhone warning her that services containing Apple user IDs had been compromised.

The message asked her to call a 1-866 number, and in the Phone app, the call looked like a call from Apple, with the number listed as 1(800)MYAPPLE, the name listed as Apple Inc., and with Apple's Infinite Loop website.

Westby contacted Apple support via the official Apple Support page and asked for an employee to contact her. She was assured that the call was not legitimate, but when looking in her recent calls list, she saw that real support call had been lumped in with the fake call.

Original scam call info on the left, with scam call info lumped in with actual Apple support call on right.

The scammers spoofed Apple's phone number and the iPhone was unable to distinguish between the real and fake calls, making it look like Westby had, in fact, been contacted by Apple multiple times, when that was not the case. Westby told Krebs that this is a convincing scam that people may fall for.
"I told the Apple representative that they ought to be telling people about this, and he said that was a good point," Westby said. "This was so convincing I'd think a lot of other people will be falling for it."
Krebs went ahead and called the number that the scammers had asked Westby to call, where an automated system claimed he had reached Apple Support. A minute later, a person came on the line and asked about the reason for the call. Krebs responded that he was told to call about a breach at Apple, was placed on hold, and the call disconnected with no resolution.

A similar report hit Twitter this morning from Fantastical developer Michael Simmons, who says he received a scam phone call that also spoofed Apple's number.


Krebs believes scammers are aiming to obtain personal and financial details from Apple users to get payment, perhaps for tech support services. As he rightly points out, it is both shocking and concerning that Apple devices are unable to tell the difference between a legitimate call from Apple and someone attempting to spoof Apple.

With these kind of phone-based scams, it's a good idea to disconnect the call and get in touch with Apple via the actual support site to avoid being fooled. Apple support does not cold call users in this manner, so these calls are almost always fake, but scammers are skilled social engineers and people do fall for these scams.

Apple has a dedicated support page with information on how to avoid fake support calls, phishing emails, and other scam techniques that malicious individuals employ to extract information from Apple users.

Top Rated Comments

(View all)

11 months ago
Why is it surprising that a phone can't tell the difference between caller id information that's fake and caller id information that's legitimate? It's indeed troubling that caller ID spoofing is so common, but this is common to all phones the display caller ID information and is something the carriers need to resolve.
Rating: 29 Votes
11 months ago
These fake/spoofed caller ID calls and robo calls would end tomorrow if they would fine the carriers; AT&T, Verizon, Sprint, et all for facilitating the transfer. The day after that gets announced, you'll see how fast those guys fix and end this garbage once and for all.
Rating: 24 Votes
11 months ago
I’ve never understood why there isn’t a simple whitelist function. I don’t want ANYONE outside of my contacts sending me email or texts, or calling me. Is it too much to ask to block people you don’t know from contacting you?
Rating: 7 Votes
11 months ago
Incorporating built-in call spoofing protection and the ability to block unknown callers would go a long way to help.

Getting rid of SS7 as the back end and going end-to-end encrypted and verified will be the long term solution to stopping this. That would have the added benefit of preventing all kinds of espionage and eavesdropping on everyone's phone calls.
Rating: 6 Votes
11 months ago

I’ve never understood why there isn’t a simple whitelist function. I don’t want ANYONE outside of my contacts sending me email or texts, or calling me. Is it too much to ask to block people you don’t know from contacting you?

Settings -> Do Not Disturb -> Allow Calls From -> {Everyone, No One, Favorites, All Contacts, ...}
Rating: 6 Votes
11 months ago
Jesus, that would probably have fooled me all the way until they asked for passwords/credit card
Rating: 5 Votes
11 months ago

I’ve never understood why there isn’t a simple whitelist function. I don’t want ANYONE outside of my contacts sending me email or texts, or calling me. Is it too much to ask to block people you don’t know from contacting you?


Whitelisting/blacklisting doesn't do anything to stop these calls because its based on caller ID which is often faked. I've been called by robo/scammers with my *own* phone number as the caller ID. There is no reason that at the absolute very least the carriers cannot weed out most if not all of these by checking against their own pool of phone numbers against the caller ID before the transfer is even made.
Rating: 5 Votes
11 months ago
You could really mess with phishers by saying, "I'm kinda busy, so lemme call you back in a little while. I'll just look up the Apple support number online… unless there's some reason I can't just use Apple's official site to contact you."
Rating: 4 Votes
11 months ago
Question is, how does the scammer know the number they are calling is an iPhone?
Rating: 3 Votes
11 months ago
Call spoofing needs to be stopped. The cons far outweigh the pros. Do something Congress, FCC, Apple, someone!
[doublepost=1546637949][/doublepost]

Question is, how does the scammer know the number they are calling is an iPhone?

They don't care. They can make calls in the millions. They're bound to hit a good percentage of iPhones.
Rating: 3 Votes

[ Read All Comments ]