Scammers exploit Apple Support system to create convincing fake alerts

New phishing scam It gets a lot of attention because it uses real Apple support tickets to trick people into giving up their accounts. Broadcom’s Eric Moret shared how he almost lost his entire Apple account after trusting what seemed like an official communication. He described the full experience in a detailed post on Medium, where he walked through the scam step-by-step.

This scheme stands out because scammers relied on it Apple’s support system To make their messages appear legitimate. They created a polished and professional experience from the first alert to the last phone call. Here’s how the scam unfolded.

Sign up for my free CyberGuy report
Get the best tech tips, breaking security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – FREE when you join my site CYBERGUY.COM Newsletter

The #1 Google Search scam everyone falls for

Experts warn that scammers are exploiting real Apple support tickets to trick users into handing over their accounts. (Photo by STR/NurPhoto via Getty Images)

How to start the scam

Moret first received a flood of alerts. These included two-factor authentication notifications claiming that someone was trying to access their iCloud account. Within minutes, he received phone calls from calm, helpful callers who claimed to be Apple customers willing to fix the problem.

The sophistication is how compelling the entire setup is. Fraudsters were able to exploit a vulnerability in Apple’s support system that allows anyone to create a genuine support ticket without verification. They opened a real Apple support case in his name, which resulted in official emails from Apple’s domain. This built instant confidence and lowered Moret’s guard.

How did the scammers gain access to the account?

During a 25-minute call, the fake agents walked Moret through what they said would secure his account. They walked him through the steps of getting him reassigned iCloud password. They also told him that a link would be followed so he could close the case.

That link took him to a fake website called AppealApple.com. The page looked official and claimed his account was locked. She then asked him to enter a six-digit code sent via text message to finish the process.

When Moret entered this code, the scammers got exactly what they needed to log into his account.

Then he received an alert that his Apple ID had been used to sign in to a Mac mini that he didn’t own. This confirmed the takeover attempt. Although the phone scammer said this was normal, he trusted his gut. He reset his password again, which kicked them out and stopped the attack.

Beware of fake credit card account scams

A Broadcom executive says he nearly lost access to his Apple ID after trusting a fraudulent support call that appeared legitimate. (Photo by Jakub Purzycki/Noor Photo via Getty Images)

How to protect yourself from Apple support ticket scam

This type of scam works because it looks real. Messages sound formal, and callers appear trained. However, you can stay safer by watching for signs that something is wrong.

1) Check support tickets within your Apple account

Scammers created a real-looking ticket to make the entire experience appear legitimate. You can confirm what’s real by checking directly with Apple. Sign in at appleid.apple.com or open the Apple Support app to view recent statuses. If the case number isn’t listed there, the message is fake, even if the email comes from an Apple domain.

2) Hang up and call Apple yourself

Never stay on a call you didn’t start. Scammers rely on long conversations to build trust and pressure you to make quick decisions. End the call immediately and contact Apple Support directly at 1-800-275-2273 or through Application support. A real agent will quickly confirm if there is anything wrong.

3) Check your Apple ID devices list

If you feel something is wrong, look at the devices your account is signed in to. Go to Settingsclick your name Then scroll to see all devices Linked to your Apple ID. Remove anything you don’t recognize. This step can quickly stop attackers if they gain entry.

4) Never share verification codes

No real support agent will ask you for your two-factor authentication codes. Treat any request for these codes as a major warning.

5) Check each link carefully

Look closely at the URLs. Fake sites often add extra words or change the format to appear real. Apple will never send you to a site like apple dot com.

Scammers are abusing iCloud Calendar to send phishing emails

Criminals use Apple’s support system to create emails of real cases that build false trust with victims. (Photo by Fairfax Media via Getty Images via Getty Images)

6) Use powerful antivirus software

Powerful antivirus software can detect dangerous links, unsafe sites, and fake support messages before you click on them. Anti-phishing tools are especially important in scams like this because the attackers used a fake website and real emails to trick victims.

The best way to protect yourself from malicious links that install malware, and potentially access your private information, is to install strong antivirus software on all your devices. This protection can also alert you to phishing emails and ransomware, keeping your personal information and digital assets safe.

Get my picks for the best antivirus protection winners of 2025 for Windows, Mac, Android, and iOS at Cyberguy.com

7) Use a data removal service

Data brokers collect your phone number, home address, email, and other details that scammers use to customize attacks. A data scraping service can scrub a lot of that information from broker sites, making you a more difficult target for social engineering attempts like the one described in this article.

While no service can guarantee complete removal of your data from the Internet, a data removal service is truly a smart choice. It’s not cheap, and neither is your privacy. These services do all the work for you by systematically monitoring and scraping your personal information from hundreds of websites. This gives me peace of mind and has proven to be the most effective way to clear your personal data from the Internet. By limiting the information available, you reduce the risk of fraudsters cross-referencing data from breaches to information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free check to see if your personal information really exists on the web by visiting Cyberguy.com

Get a free check to see if your personal information is already on the web: Cyberguy.com

8) Turn on powerful multi-layer protection

Save Two-factor authentication (2FA) For each main account. This creates a barrier that quickly stops attackers.

9) Slow down before responding

Scammers want you to panic. Stop before you act. Trust your instinct when something feels rushed or strange. A short delay may save your entire account.

Click here to download the FOX NEWS app

Key takeaways for Kurt

This scam shows how convincing criminals can be when they exploit real systems. Even careful users can fall into the trap of official-sounding messages and professional-sounding calls. The best defense is to stay alert and take a moment before reacting to anything unexpected. When you slow down, double-check support tickets, and never share verification codes, you make it more difficult to get scammed. Add layers like Virus protection Data removal services also give you more control over what attackers can access. These simple habits can stop even the most subtle scams before they reach your accounts.

What would you do if you received a support call that seemed real but didn’t ring true? Let us know by writing to us at Cyberguy.com

Sign up for my free CyberGuy report
Get the best tech tips, breaking security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – FREE when you join my site CYBERGUY.COM Newsletter

Copyright 2025 CyberGuy.com. All rights reserved.