How to Spot a Fake Apple Text or Email

Published August 12, 2026 · Last reviewed September 2, 2026

The four tells

1. Manufactured urgency. “Your Apple Account has been locked”, “your iCloud storage expires today”, “unusual sign-in detected — confirm within 24 hours”. Urgency exists to stop you thinking. Genuine account problems wait patiently in Settings.
2. A link instead of a location. Real guidance tells you where to go on your device. A phishing message must give you a link, because the link is the entire attack.
3. A domain that is not apple.com. Attackers use lookalikes: apple-support-id.com, icloud-verify.net, appleid.apple.com.secure-login.co. Read the domain from the right: the real domain is the part immediately before the first single slash.
4. A request for a code, password, or remote access. No legitimate Apple process asks you to read a verification code aloud, type your password into a page you reached from a text, or install a screen-sharing app.

The scripts currently in circulation

These are the patterns most iPhone owners see. They change wording constantly; the structure does not.

What to do with a suspicious message

Action

Do not tap anything, including “unsubscribe” or “this is not me”.

Why it helps

Any tap confirms the number reached a real person, which raises its value and increases what you receive.

Verification

The message stays unopened in your list.

Action

Report it: in Messages, use Report Junk under an unknown-sender conversation; in Mail, mark it as junk. In the UK you can forward scam texts to 7726.

Why it helps

Reporting feeds carrier and platform filters, which reduces what reaches other people.

Verification

The thread is removed and the sender is filtered.

Action

Check the claim independently by opening Settings and tapping your name, rather than by following the message.

Why it helps

It answers the actual question — is something wrong with my account — through a route an attacker cannot fake.

Verification

You see your real account status, device list, and storage figures.

Action

If you already entered a password, change it immediately and check the device list for anything you do not recognise.

Why it helps

Speed matters more than embarrassment; an attacker with a fresh password is racing you to add a trusted device.

Verification

The password is changed, and every device in the list is yours.

Turn on the filter that removes most of them

Open Settings › Apps › Messages and turn on Filter Unknown Senders (on older iOS this is Settings › Messages). Messages from numbers not in your contacts move to a separate tab and stop generating notifications. It does not delete anything, so a genuine message from a delivery driver still arrives — it just no longer interrupts you, and scams sit quietly in a list you check when you choose to.

The one rule to teach everyone else

If you have a family member who worries about this, give them a single sentence rather than a checklist: “Never do something urgent because a message told you to. Close it, and go look in Settings yourself.” That rule handles fake Apple texts, fake bank texts, and fake delivery texts without needing anyone to become a security expert.

How it works

Phishing works on pretext and pressure, not on technical compromise. The attacker does not break into your account; they persuade you to open the door. The message is engineered to trigger a fast, emotional response — fear of losing access, fear of a fraudulent charge, worry about a missed delivery — because a person acting quickly does not examine a domain name.

The technical part is simple and cheap. Sender names and numbers are trivially spoofed, so a text can appear in the same thread as genuine messages from a company. A cloned sign-in page costs nothing to host and can be pixel-identical to Apple's, because every image and stylesheet on a public page can be copied. Nothing about how the message looks can therefore be trusted, which is why every reliable tell is about what it asks.

This is also why the defence is structural rather than perceptual. Instead of trying to spot a good fake, you remove the attacker's channel entirely: never act inside their message, always verify inside Settings or by typing a domain you already know. A fake page cannot intercept you if you never arrive at it.

Worked example

A text arrives at 8:12 on a Tuesday: “Apple: Your Apple Account has been temporarily locked due to unusual activity. Verify within 24 hours to avoid permanent suspension: apple-verify-id[.]com/secure”. It appears in a thread alongside two genuine two-factor codes from months ago, which makes it feel legitimate.

Run the four tells. Urgency: yes, a 24-hour deadline. A link rather than a location: yes. Domain: reading from the right, the real domain is apple-verify-id.com — owned by whoever registered it, not by Apple. Request for credentials: the page it leads to will ask for the password. Four out of four.

The response takes forty seconds. The message is reported as junk and not tapped. Then Settings is opened, the account name tapped: no warning banner, no restriction, three familiar devices listed. The claim was false, confirmed through a route the attacker had no access to. Nothing else needed to happen — and critically, the check would have been just as conclusive if the account had been locked, because the real status always lives in the same place.