Blog

This month, Apple updated a security support document that provides iPhone, iPad and Mac users with tips on how to recognize and avoid social engineering schemes such as phishing messages and fake support calls.

The updated information follows recent reports of “smishing” attacks targeting Apple IDs. Malicious actors send SMS text messages that attempt to trick users into providing their Apple ID usernames and passwords to a fake iCloud website.

Apple’s guidelines provide key information that all users should know to protect themselves, such as the recommendation to ignore messages with suspicious links. Apple says it won’t ask for ‌Apple ID‌ passwords or verification codes, and users should contact Apple directly instead of answering a suspicious phone call or message purporting to be from Apple.

Additionally, Apple will not require users to sign in to any website, tap Accept in the two-factor authentication dialog, or enter a two-factor code on a website. Apple also won’t require users to disable features like two-factor authentication, Find My, or Stolen Device Protection. Apple Security Tips:

• Never share personal or security information such as passwords or security codes, and never agree to enter them on a web page that someone directs you to.
• Protect your ‌Apple ID‌. Use two-factor authentication, always keep your contact information secure and up-to-date, and never share your ‌Apple ID‌ password or verification codes with anyone. Apple never asks for this information to provide support.
• Never use Apple Gift Cards to make payments to other people.
• Learn how to identify legitimate Apple emails for your App Store or iTunes Store purchases.
• Learn how to protect your Apple devices and data.
• Only download software from sources you can trust.
• Do not follow links or open or save attachments in suspicious or unwanted messages.
• Do not answer suspicious phone calls or messages that claim to be from Apple. Instead, contact Apple directly through official support channels.

Scammers will go to great lengths to obtain personal information, so Apple recommends watching out for tricks like creating a sense of urgency through scare tactics like stolen personal information or unauthorized charges. Scammers are looking for login information and security codes, so information should not be entered on a website accessible via a link in a text or email.

Apple also warns against downloading unrecognized, dangerous software and configuration profiles and following instructions in pop-up windows. Users who receive a pop-up should ignore the message and close the entire window or tab.

Apple has additional instructions on how to spot social engineering schemes, the forms these schemes can take, and how to report suspicious emails, messages, and phone calls. There is a separate support document on what to expect from Apple Support and the types of information Apple will not request.