If you get a phone call claiming to be from Apple warning of an iCloud breach, beware: It’s a trick.
Telephone scammers are cold-calling people, claiming that iCloud, Apple’s cloud service, has been hacked, and asking them to give up their accounts details.
They seem to be exploiting the recent headlines about a group of hackers who claim to have access to hundreds of millions of iCloud user accounts. (In short: iCloud wasn’t hacked, although bad password practices mean many people’s accounts are still vulnerable — but more on that in a moment.)
There are numerous accounts of people being called by the fraudsters online. Glenn Fleishman, writing for Macworld, says his wife was called five times by them. Twitter is full of similar tales — with some people falling for the phishing scam.
The scam is a simple one. The potential victim receives an automated message that claims to be from Apple’s support, telling them there is an issue with their iCloud account or that it has been breached. They’re then put through to a human to “help” them.
Kiro 7 spoke to people in Seattle who were targeted who said they were then asked for “personal information,” which could potentially give the scammer access to the victim’s account, allowing them to make purchases or do whatever else they want.
Or, as Macworld points out, these scammers sometimes direct the victim to install “antivirus software” — in reality, malware — onto their computers, and charge them for the privilege.
Apple advises its users that you should “never provide personal account information — including your Apple ID password, credit card info, or other personal information — by email or text message, and use extreme caution when clicking links in messages or sharing information over the phone. Instead, visit the company’s website directly or call them yourself.”
These kind of cold-call iCloud scams aren’t new. But recent headlines have given them a renewed potency, as potential victims could see the news and become confused.
Earlier in March, Motherboard reported that a hacking group claimed to have hundreds of millions of iCloud logins. Apple says it hasn’t been breached — meaning this data was likely to have come from a previous hack elsewhere, like LinkedIn.
The problem is that people keep reusing their passwords over and over. This means if a site where they have an account (e.g. LinkedIn) is hacked and their password is made public, then every other service where they have an account (e.g. iCloud) is now vulnerable.
And that’s the important point. In theory, phone scammers can’t do anything if you don’t give them your details or do what they say. But if you’ve reused the same password multiple times, then anyone might be able to gain access to your account.
Security experts recommend you use a different, strong password for each account, storing them with a password manager app if necessary, and that you enable two-factor authentication wherever possible.
More from Business Insider UK:
- Facebook’s little-known billionaire cofounder is funding a London startup
- More banks will announce Brexit relocation plans to Europe ‘within weeks’
- You can earn £24,000 flying drones for Google if you have ‘a tolerance to coffee and French people’
- The 10 things in advertising you need to know today
- People in the embattled House Intel chair’s California district are cutting him some slack amid Trump-Russia turmoil
Have you gotten a call from scammers claiming to be Apple saying your iCloud infor was compromised… They called to Harris Jack 6 times! pic.twitter.com/PMberwR8yR
— Henry Rosoff (@HenryKIRO7) March 30, 2017
Gone Phishing: Twice today robot calls warning me of an iCloud breach with a Call back # 844-822-2855
Apple says this is BOGUS.
— Paul Bergman (@ThePaulBergman) February 28, 2017