How to identify and report phishing to Apple

Phishing is a particularly nasty form of hacking because it preys on people who may be vulnerable or whose knowledge of technology isn’t particularly good. It’s usually carried out by email, but text messages, phone calls, and direct messages on social media are also used for phishing.

One of the things that makes attacks like Apple ID phishing so nasty and so difficult to guard against is that the emails used are designed to look like they come from an ‘official’ source. It could be designed to look like it’s a message from Apple telling you that you need to update your Apple ID details or payment details on the App Store. Or it could be an email pretending to come from Google telling you that your security information is out of date or someone has tried to access your account.

The objective of a phishing email is usually to persuade you to click a link that you think will take you to the website of the company the email is supposed to have come from. Instead, the link takes you to a website run by hackers — usually set up to look like the website of the company they are imitating. Once you’re there, the hackers hope you will type in your user ID, password, and even financial details so that they can steal them.

How to spot phishing emails

Most phishing emails are designed to attempt to access online accounts with banks, credit card companies, or organizations that store personal data, such as Apple, Facebook, and Google.

Typical phishing email purporting to be a Walmart offer:

Recently, there have been Apple ID phishing email messages arriving in Mac and iOS users’ inboxes. These spoof Apple emails, or fraud emails, to be more precise, claim that there is a problem with the user’s Apple ID and that their account will be closed if action isn’t taken.

While phishing emails have become more sophisticated and are increasingly difficult to spot, there are several things you can do to protect your Mac from phishing and spot, for example, Apple ID phishing. If you believe that Mac security is a common responsibility, you should know how to report phishing to Apple.

1. Don’t click the links in emails

Never ever click on a link in an email unless you are 100% sure where it’s come from. If you’re not expecting the email, check that it’s legitimate before you click anything. If it claims to come from an organization with whom you have an account, don’t click the link; instead, go to their website or app and log in there.

2. Read the email carefully

Are there any spelling mistakes or grammatical errors? These are a common giveaway for phishing emails. Banks, big companies, and government departments don’t make silly spelling mistakes in emails. So, it could easily be a phishing attempt.

3. Check the email for logic 

Is it telling you there’s a problem with an account linked to an email address that’s different from the email address you use with that account? That’s another giveaway.

4. Check the email address of the sender 

In the modern Apple’s Mail app and some other email clients, the sender field doesn’t display the email address by default. It shows just the name of the sender, which can be whatever the sender wants it to be. However, if you mouse over the sender’s name and click the down arrow next to it, you will see the actual email address. Does it match the claimed identity of the sender?

5. Check the destination of the link

Don’t click the link. However, if you hover over it with the mouse pointer, you will see a tooltip that displays the real destination. If it’s a website that doesn’t match the organization from which the email claims to come, it’s a phishing email. 

You should also remember that no bank or reputable company will ask you to reveal a password or other sensitive data by email. And most companies recognize that users are now wary of clicking on links and will either not ask you to do so in an email or provide an alternative.

What to do if you suspect you’ve been phished

If you’ve clicked a link and typed in your credit card number and you now suspect it was fraudulent, contact your credit card company straight away and cancel the card, telling them why. Likewise, if you typed in banking information, contact your bank. If the details you entered in the spoof site were a username and password, contact the company that runs the real site and let them know.

1. Scan your Mac for threats

If you suspect a link you clicked downloaded something to your Mac, run a scan with a tool like CleanMyMac X. It can identify thousands of malware threats, so you can remove them for good. With the help of CleanMyMac X, you can easily get rid of adware, worms, spyware, ransomware, cryptocurrency miners, and more.

Here’s how to run a thorough malware scan on your Mac:

1. Download the free version CleanMyMac X and launch the app — this tool is notarized by Apple.
2. Choose the Malware Removal tab.
3. Click Scan.
4. Click Remove.

2. Teach Mail about phishing emails

The good news is that most modern email clients, including Apple Mail, are very good at identifying junk emails, including phishing messages. However, occasionally, some do get through. Once you’ve identified a message as a phishing email, don’t just delete it. Mark it as junk. That way, your email client will learn and be better informed next time it encounters a phishing email from the same source.

Do you use MS Office Suite? Here’s how to block phishing emails in Outlook on Mac:

1. Select the spam email and right-click on it.
2. In the menu that appears, click “Block sender.”

3. Report phishing to Apple

You can issue a complaint to the Gmail team or report spam to Apple — their support article explains how. Like most responsible companies, Apple wants to know when its users are sent phishing emails so that they can analyze these scams and attempt to stay one step ahead of the hackers. 

You can report phishing to Apple using this email address: [email protected]

As you can see, while phishing emails can seem quite frightening, there is plenty you can do to identify them. The most important lesson is not to click on any link in any email or text message unless you are absolutely certain who has sent it to you. If it comes from a business, it’s much better to go to their website and log in manually. That way, you won’t risk being redirected to a spoof website.

Frequently Asked Questions

Are Mac users still vulnerable to phishing?

The short answer is yes. Recent data shows that phishing incidents affecting Macs specifically grow at a 30-40% rate per year. To minimize the risk, always update your macOS and your email client to the latest versions. 

What to do if you click on a phishing link on Mac?

First of all, unplug from the internet. Check your Mac for malware. You can use CleanMyMac X’s Antivirus tool — this software is notarized by Apple. Finally, change your important passwords.

Has my Mac been affected?

You can check if your Mac is affected by phishing by running a security scan on your computer. Other signs of phishing activity:

• Suspicious purchase receipts in the mail.
• Fake Apple support emails.
• “Your Mac is locked” messages.