Phishing and Online Shopping Scams: How to Spot Them and What to Do on iPhone and Mac

Scams that pretend to be Apple, your bank or an online shop all work the same way. They try to hurry you into handing over a password, a security code or money. This guide covers the Apple Account scams we see most, the online shopping scams that spike around big sales, and what to do if you have already clicked.

How scams reach you

Scams reach you in several common ways. They include fraudulent emails and messages that look like they come from a real company, including Apple, and pop-ups and ads that say your device has a security problem. They also include phone calls and voicemails that pretend to be Apple Support, fake promotions that offer free products and prizes, and unwanted Calendar invitations and subscriptions. Another route is a website, email or message that tells you to paste a command into Terminal.

If you are suspicious about an unexpected message, call or request for your email address, phone number, password, security code or money, treat it as a scam until you can verify it independently.

The Apple Account scam

A typical message says there is suspicious activity on your Apple Account, a failed iCloud payment or a purchase you did not make. It urges you to act and gives you a button. The button leads to a page that looks like Apple’s sign-in page and asks for your password and then a verification code.

Scammers try to get sign-in details, security codes and financial information. Never share your Apple Account password or verification codes with anyone; Apple never asks for them to give support. Never agree to enter them into a web page that someone directs you to.

Stop, check, protect, speak up

For any suspicious message or call, use four steps.

1. Stop. Pause before you click, call back or reply, especially if the message creates urgency.
2. Check. Does the sender’s address match the name of the company? Does the web address match the company’s real website? Let unknown callers go to voicemail. If a message or call seems genuine, call back using the official number on the company’s own website, not one from the message.
3. Protect. Lock your devices with Face ID or Touch ID. Use strong passwords, two-factor authentication and passkeys. Never use Apple Gift Cards to pay another person.
4. Speak up. If you have lost money, report it to your bank or card provider straight away and ask them to stop any transactions.

If you have already entered your details

If you think your Apple Account has been compromised, or you might have entered your password or other personal information on a scam website, change your Apple Account password immediately and make sure two-factor authentication is on. Take these steps straight away:

1. Change your password to a strong, unique one. If someone else has already changed it, reset it.
2. On an iPhone or iPad, open Settings, tap your name, then tap Sign-In & Security and change the password. On a Mac, open System Settings, click your name, then click Sign-In & Security.
3. In the same Apple Account settings, review the devices signed in to the account and remove any device you do not recognise.
4. Confirm that you still control every email address and phone number used for account recovery. If anything looks wrong, contact the email or mobile provider straight away and ask them to check for changes such as SMS forwarding.

If the password cannot be reset or the account cannot be opened, use Apple Account recovery. It involves a waiting period.

Signs of a compromised account include: You get a notification or email about activity you do not recognise, or a verification code you did not request. There is unusual activity, such as messages you did not send or devices you do not recognise. Your password no longer works, or your device has been locked or put into Lost Mode by someone else.

Online shopping scams

Scammers copy sale seasons such as Black Friday and Boxing Day. The usual forms are fake shops with prices that are too good to be true, marketplace adverts that ask for payment up front, and text messages that pretend to come from a courier.

Be wary of rare or heavily discounted items, especially when a seller creates urgency. Check unfamiliar stores by searching their name with the word scam, and type the store address yourself instead of following an unexpected link. Check the spelling of the address, then confirm the store shows a privacy policy, terms and conditions, contact details and an ABN. Look for independent reviews.

Be careful with unusual payment requests. If a bank transfer or PayID shows a different name, do not pay, and treat any request for gift cards as a warning sign. Inspect high-risk purchases in person where possible, including pets. A seller who refuses is a warning sign.

Delivery messages

A text or email that says a parcel is waiting and asks for a fee or personal details is a common scam. Do not follow the link. Check the delivery through the retailer’s own app or website instead.

Related guides

Fake virus warnings are another route scammers use. See our guide to Safari pop-ups and fake virus warnings on a Mac and our guide to whether you need antivirus on a Mac.

Not sure? Ask before you act

If you are unsure about a message, we are happy to check it with you before you click. See our Online Safety & Protection service for home users, or our Security & Email Protection service for businesses. Contact Your Mac Tech at any time.