Fake Apple Pay charge page pushed iPhone users to call scammers

What happened

Malwarebytes found a web page that fakes a $657 App Store charge and an "Apple ID locked" alert. It reads a warning with a phone number aloud and makes the page hard to leave, pushing the user to call.

The "Face ID" prompt on the page is just text in the page, not a real system dialog.

What was found

Calling the number leads into a classic tech-support scam. The report is based on a single sample and gives no victim count.

Data at risk

• Whatever you tell the caller

What you should do

1. 1"Face ID" and "account locked" prompts on a web page do not come from iOS; do not call the number shown.
2. 2To check a charge, go to Settings → [your name] → Media & Purchases, or open your bank app.
3. 3If you cannot leave the page, close the tab or quit the browser.