The Apple scam, which appears to be a legitimate customer service email from the tech giant, gives the recipient the impression that their account information is missing or incorrect.
Below is a sample of the email that users should look out for:
Although the email purports to originate from Apple, it actually originates from a domain that was purchased last month, specifically to be used in Apple phishing attacks (appei-case.uk).
Email recipients are invited to click the link ‘Click here to Verify your ID’. This URL redirects users to a landing page which is an excellent replica of a legitimate Apple account ‘Sign in’ page.
Notice that the domain ‘appel-signin.com’ was created to fool viewers into believing it is a legitimate Apple domain. Signing in on this page hands your login credentials straight to the cybercriminals. Clicking ‘Sign in’ redirects users to a second landing page, again a credible replica of an authentic Apple landing page, hosted on the same domain:
The cybercriminals, in an attempt to phish for personal information, suggest your Apple ID has now been locked. Clicking ‘Confirm My Account’ redirects the user to yet another landing page hosted on the same domain.
The information phished on this page can be used by cybercriminals to access other personal accounts and enables the cyber criminals to engage in identity theft.
After handing over credit card details, the user is finally redirected to a landing page suggesting their account details have now been verified. The spelling errors on this page are a give away that this is a phishing scam i.e. ‘informations’ and ‘acces’.
Why phishing emails are bad for business
Although this fake Apple phishing email is primarily targeted towards consumers, cybercriminals also use phishing emails to manipulate employees into surrendering access to a range of sensitive and valuable business information.
This can include access to your corporate usernames and passwords used to access and steal confidential data, or verification information used to access your business bank accounts and appropriate funds.
The financial, reputational and litigation costs associated with phishing can be huge, and it’s important that your business takes steps to protect itself.
If you’ve received this Apple email scam, Apple asks that your forward it to email@example.com. The company also offers a range of information on how you can identify and report suspected phishing emails involving Apple.
We recommend that you educate staff on how to spot phishing emails in the event that they infiltrate your email inbox – you can access a range of hints and tips here.
For a few dollars per staff member per month, add MailGuard's cloud-based email and web filtering solution to your business security. You’ll significantly reduce the risk of new variants of malicious email from entering your network.
Our benchmarking shows that MailGuard is consistently 2-48 hours ahead of the market in preventing new attacks.
Find more tips on cybersecurity by subscribing to MailGuard’s blog.
Keep up to date on the latest email scams by subscribing to MailGuard’s weekly update or follow us on social media.