iPhone Scam Call ‘From Apple’

Variant 1 — “Your Apple ID has been compromised” cold call

How it presents: An incoming call. The caller ID displays “Apple Inc”, “Apple Support” or a recognised Apple phone number (often the genuine Apple Support number, spoofed). An automated voice or a live agent says: “This is Apple Support. We’ve detected unauthorised access to your Apple ID from [country]. Press 1 / stay on the line to speak to an agent and secure your account.”

Red flags:

• Apple does not cold-call customers. Real Apple security communications appear as in-app notifications inside the Apple ID settings on your device. They do not arrive as unsolicited phone calls.
• Caller-ID spoofing is trivial. The displayed name and number can be set to anything. Even Apple’s genuine number (0800 048 0408) can be spoofed. The caller ID is not evidence the call is real.
• Reference to suspicious sign-in from a foreign country. Real Apple does send sign-in notifications — but only to your registered email and inside your device’s notifications, never via phone call.
• They will ask for your Apple ID password. Apple never asks for your password by phone, email, or text. The password request is the diagnostic moment.
• They will ask you to install a remote-support tool. Apple Support uses Screen Recording or Apple Remote Desktop in customer-initiated sessions only — never installed via cold call.
• The endgame is often Apple gift cards. A common variant ends with “to verify your identity, purchase £500 of Apple gift cards from the nearest shop and read me the codes”. This is the scam. Apple never accepts gift cards as ID verification.

Variant 2 — iCloud / Safari browser security alert pop-up

How it presents: While browsing on iPhone or iPad (often after tapping a suspicious link, watching streaming content on an irregular site, or visiting compromised sites), a full-screen Safari pop-up appears: “APPLE SECURITY ALERT — your iPhone has been hacked. iCloud data at risk. Call Apple Support immediately: 0800-XXX-XXXX.” The page may include a fake Apple logo, alarm tone, and prevent normal navigation.

Red flags:

• iOS does not display security warnings via Safari pop-ups. Real iOS security notifications appear in the device’s Notification Center or in the Settings app, never as full-screen Safari pages.
• Real Apple alerts never include a phone number to call. Apple does not display phone numbers in any security warning, ever.
• The page tries to lock the browser. Repeated alert dialogues, audio loops, full-screen API tricks — all designed to discourage you from closing the tab. None of this is part of real iOS or Safari behaviour.
• To dismiss: close the Safari tab, or force-quit Safari. On iPhone: swipe up from the bottom (or double-tap home on older models), swipe Safari up to close, reopen Safari. The pop-up has no persistence beyond the tab.
• If you call the number: the same script as Variant 1 begins — password request, gift-card request, or remote-access install.
• Clear Safari history and website data: Settings > Safari > Clear History and Website Data. This removes any cached scam pages.

Variant 3 — Fake Apple refund / billing scam (reverse refund pattern)

How it presents: An email or call claims you’re entitled to an unexpected refund for an Apple subscription / App Store purchase you didn’t make (or that “Apple processed by mistake”). The caller asks you to log in to your online banking to receive the refund. While remote-accessing via screen-share, they manipulate the display to show a larger refund than intended. They then claim they’ve refunded too much and ask you to wire the “extra” back to a foreign account or buy Apple gift cards to repay.

Red flags:

• Apple does not refund via remote-access banking sessions. Real Apple refunds are credited to the original payment method automatically and visible in your Apple ID Account > Purchase History.
• The displayed bank balance is manipulated, not real. Remote-access tools let the scammer show you a doctored view of your banking page. The “extra refund” never existed; the money you’re asked to send is your own.
• Apple gift cards / wire transfer / crypto as the repayment route. No legitimate refund correction uses these channels. Apple itself doesn’t accept Apple gift cards as payment for refunds — the request is structurally impossible for a real Apple process.
• This variant disproportionately targets older iPhone owners. The combination of a believable Apple-billing narrative + screen-share manipulation is among the highest-loss-per-victim patterns. Talk to older relatives about it specifically.
• Real Apple billing-dispute is initiated by you at reportaproblem.apple.com — the official site for refund requests on App Store and subscription charges. Real disputes never require remote access to your computer.