Real Apple account alerts were abused to send scam emails

What happened

Attackers split scam text across the first- and last-name fields of an Apple ID, then changed the account's shipping details. That triggers Apple's genuine "account updated" email, which then shows text like "899 USD iPhone Purchase Via Pay-Pal To Cancel" and a phone number.

The email really comes from Apple, so it passes SPF, DKIM and DMARC checks.

What was found

Calling the number leads to a fake support desk that may ask victims to install remote-access software or share financial information. BleepingComputer asked Apple about it and got no reply; at publication the trick still worked. Only one sample has been reported, with no victim count.

Data at risk

• Remote device access
• Financial information

What you should do

1. 1Do not call a number in an account email; check through Apple's official channels.
2. 2To check a charge, go to Settings → [your name] → Media & Purchases, or open your bank app.
3. 3If you think your account was changed, sign in to your Apple Account page and check the name and shipping details.