A fake Apple Support iMessage scam arrives as a text or iMessage that looks like it came from Apple: “Unusual Apple ID sign-in,” “Your iPhone will be locked,” “Activation Lock / Find My alert,” or “Support Case #… tap to continue.” The link opens a clone of appleid.apple.com or an “Apple Advisor” chat that harvests your Apple ID, password, and two-factor codes—or demands gift cards, crypto, or remote access to “unlock” the device. Real Apple Support does not cold-text you into pasting passwords on a third-party page or reading iTunes PINs aloud.
Closely related storage-upgrade phish: Fake iCloud storage-full scams. Remote-access refund layering: Fake tech-support refund scams. Broader takeover map: Phishing and account takeover.
How the iMessage / lock-screen script works
- A text or lock-screen-style banner claims your Apple ID was used in another country, your device will brick, or iCloud payment failed.
- “Call Apple Support” or “Verify now” uses a lookalike URL or a phone number from a search ad—not support.apple.com you typed yourself.
- After you sign in, attackers add a trusted device, change recovery contacts, or buy subscriptions on the card on file.
- An “Advisor” then demands Apple Gift Card or Google Play PINs to “clear a pending lock” (Gift cards and prepaid debit risks).
- Screen-sharing via Quick Assist, AnyDesk, or TeamViewer may follow so they can move money or install persistence.
| Tell | Why it matters |
|---|---|
| Link domain is not apple.com / icloud.com / support.apple.com | Credential harvest |
| Urgency: “locked in 30 minutes” unless you pay | Fear script |
| Demands gift-card PINs for Support | Apple does not unlock accounts that way |
| Caller already knows your Apple ID email | Harvested from the phish |
| Pop-up you cannot dismiss without calling a number | Often fake system UI or malware |
Worked example
Priya gets an iMessage: “Apple ID: sign-in from Moscow. If this wasn’t you, secure your account: https://appleid-secure-support.com/…”. She enters Apple ID, password, and the six-digit code from Settings. Minutes later Find My shows a new MacBook. A follow-up iMessage from “AppleCare+ Billing” asks her to buy $300 in Apple Gift Cards to reverse a “fraud hold.” Healthy version: Priya ignores the link, opens Settings → [her name] → Sign-In & Security on the iPhone she already holds, reviews devices, and only contacts Apple through the Support app or support.apple.com she types. No gift cards, no third-party remote tools from a cold text.
What real Apple Support contact looks like
- You usually start the conversation: Support app, support.apple.com, or an Apple Store Genius Bar appointment you booked.
- Apple may email about Apple ID security or purchases, but password entry belongs on appleid.apple.com / device Settings you navigate to yourself—not a link in a random iMessage.
- Apple will not ask you to pay Support fees with gift-card PINs, wire, or crypto.
- Device Activation Lock and Find My settings live on the device and Apple ID account pages—not in a stranger’s chat window.
If the text also claims your bank froze an Apple charge, hang up the money path and use the number on the back of your card. Landscape: Credit and debt scams.
If you already tapped, logged in, or shared codes
- On a trusted device, change the Apple ID password; remove unknown devices; review recovery phone/email.
- Check Subscriptions and payment methods at Apple for charges you did not start; call the issuer.
- Revoke app-specific passwords; turn on stronger account protections where available.
- If remote access was granted, assume the device is compromised—reset passwords for email and banking from a clean device.
- Report to Apple’s fraud channels and FTC; consider a credit freeze or fraud alert if financial data leaked.
- Ignore “second helper” callers who offer to undo the first scam for another fee.
Checklist
- Never enter Apple ID credentials from a cold iMessage, SMS, or lock-screen link.
- Manage Apple ID security only from device Settings or appleid.apple.com you typed.
- Never pay Support / unlock fees with gift-card PINs or crypto.
- Refuse remote-access tools pushed by unsolicited “Apple Advisors.”
- After any credential entry, purge unknown devices and review billing.
- Prefer the official Support app over phone numbers in texts or search ads.
Educational only. Not legal, security, or fraud-recovery advice. Scam scripts change; verify through official Apple Support channels and your financial institution.