If you get a phone call claiming to be from Apple warning of an iCloud breach, beware: It's a trick.
Telephone scammers are cold-calling people, claiming that iCloud, Apple's cloud service, has been hacked, and asking them to give up their accounts details.
They seem to be exploiting the recent headlines about a group of hackers who claim to have access to hundreds of millions of iCloud user accounts. (In short: iCloud wasn't hacked, although bad password practices mean many people's accounts are still vulnerable -- but more on that in a moment.)
There are numerous accounts of people being called by the fraudsters online. Glenn Fleishman, writing for Macworld, says his wife was called five times by them. Twitter is full of similar tales -- with some people falling for the phishing scam.
If you guys get a random call from "Apple Support" don't fall for it guys. I just got hacked and lost all my money. pic.twitter.com/trcI4TKkHB-- steff (@steffartnieee) March 27, 2017
Have you gotten a call from scammers claiming to be Apple saying your iCloud infor was compromised... They called to Harris Jack 6 times! pic.twitter.com/PMberwR8yR-- Henry Rosoff (@HenryKIRO7) March 30, 2017
Gone Phishing: Twice today robot calls warning me of an iCloud breach with a Call back # 844-822-2855-- Paul Bergman (@ThePaulBergman) February 28, 2017
Apple says this is BOGUS.
The scam is a simple one. The potential victim receives an automated message that claims to be from Apple's support, telling them there is an issue with their iCloud account or that it has been breached. They're then put through to a human to "help" them.
Kiro 7 spoke to people in Seattle who were targeted who said they were then asked for "personal information," which could potentially give the scammer access to the victim's account, allowing them to make purchases or do whatever else they want.
Or, as Macworld points out, these scammers sometimes direct the victim to install "antivirus software" -- in reality, malware -- onto their computers, and charge them for the privilege.
Apple advises its users that you should "never provide personal account information--including your Apple ID password, credit card info, or other personal information--by email or text message, and use extreme caution when clicking links in messages or sharing information over the phone. Instead, visit the company's website directly or call them yourself."
These kind of cold-call iCloud scams aren't new. But recent headlines have given them a renewed potency, as potential victims could see the news and become confused.
If you are an @Apple user and get a phone call about a breach in your iCloud act....it is a SCAM just hang up.-- Alison Reynolds (@BigAlPeoplesPal) January 8, 2017
Earlier in March, Motherboard reported that a hacking group claimed to have hundreds of millions of iCloud logins. Apple says it hasn't been breached -- meaning this data was likely to have come from a previous hack elsewhere, like LinkedIn.
The problem is that people keep reusing their passwords over and over. This means if a site where they have an account (e.g. LinkedIn) is hacked and their password is made public, then every other service where they have an account (e.g. iCloud) is now vulnerable.
And that's the important point. In theory, phone scammers can't do anything if you don't give them your details or do what they say. But if you've reused the same password multiple times, then anyone might be able to gain access to your account.
Security experts recommend you use a different, strong password for each account, storing them with a password manager app if necessary, and that you enable two-factor authentication wherever possible.
This post originally appeared on Business Insider.