A fake iCloud “storage full” scam uses Apple-looking emails, texts, pop-ups, or search ads that say your iCloud is full and your photos will be deleted unless you “upgrade now.” The link opens a clone of appleid.apple.com or iCloud settings and harvests your Apple ID, password, and two-factor codes—or demands payment by gift card, wire, or crypto for a storage plan Apple does not sell that way.
This guide covers the storage-full phish, the payment variant, and what to do if you already typed credentials. Related patterns: Phishing and account takeover, Fake tech-support refund scams, and Fake bank security alerts.
How the script works
- An email/SMS/browser pop-up says iCloud storage is full and Photos, Messages, or device backups will stop in hours.
- The “Manage Storage” button goes to a lookalike Apple ID login, not Settings on your iPhone/iPad/Mac.
- After you sign in, attackers change recovery contacts, buy subscriptions on your card on file, or sell access to the account.
- A call or chat then offers to “fix the bill” or “upgrade to 2 TB” if you pay with iTunes/Google Play cards or crypto (Gift cards and prepaid debit risks).
- Remote-access “Apple Advisor” scripts may follow—classic tech-support refund layering.
| Tell | Why it matters |
|---|---|
| Link domain is not apple.com / icloud.com | Credential harvest |
| Demands gift-card PINs for storage | Apple bills storage to the payment method on your Apple ID |
| Pop-up you cannot dismiss without calling a number | Often malware or a fake system alert |
| Caller already knows your Apple ID email | Harvested from the phish form |
| “Refund” only after another payment | Second-stage fraud |
Worked example
Sam sees a banner ad: “iCloud Full - Upgrade before photos delete.” The page clones Apple’s sign-in. Sam enters Apple ID, password, and the six-digit code from the phone. Minutes later Sam’s Find My shows a new trusted device. A “Senior Apple Advisor” calls offering to remove a $499 storage charge if Sam reads three $100 Apple gift cards “for a reverse transfer.” Sam declines the cards but the Apple ID is already compromised.
Sam’s next steps: on a trusted device go to Settings → [name] → Sign-In & Security (or appleid.apple.com typed manually); change password; remove unknown devices; review payment methods and subscriptions at Apple; enable stronger protections; report to FTC and Apple’s fraud channels; ignore follow-up “recovery” callers. Broader fraud patterns: Credit and debt scams.
What real iCloud storage upgrades look like
- Start in Settings → [your name] → iCloud → Manage Account Storage (wording varies by iOS/macOS version) or through Apple’s official account site you navigate to yourself.
- Apple charges the card, Apple Cash, or other payment methods already on the Apple ID—not Steam codes read to a stranger.
- Storage-plan emails from Apple do not require you to paste passwords into a third-party form.
- Apple Support you contact through official Support app / support.apple.com paths will not ask for gift-card PINs.
If a “storage alert” also claims your bank froze a charge, hang up and use the number on the back of the card (Fake bank security alerts).
Checklist
- Manage iCloud storage only from device Settings or appleid.apple.com / iCloud settings you typed.
- Never enter Apple ID credentials from a cold email, SMS, search ad, or pop-up.
- Never pay storage upgrades with gift-card PINs or crypto to a caller.
- After any credential entry, change the Apple ID password, purge unknown devices, and review billing.
- Document phishing URLs and amounts; report to FTC, Apple, and your card issuer if charged.
- If financial data was exposed, consider a credit freeze or fraud alert.
Fake Apple Support iMessage / lock-screen “secure your Apple ID” texts: Fake Apple Support iMessage scams.
Educational only. Not legal, security, or fraud-recovery advice. Scam scripts change; verify through official Apple Support channels and your financial institution.