Scam of the day – May 30, 2017 – Apple iTunes phishing scam

Phishing emails, and the more personally tailored spear phishing emails are the most common way that people and companies are tricked into downloading malware such as ransomware or keystroke logging malware used to steal information from the victim for purposes of identity theft. Effective phishing emails will appear to be legitimate and lure victims into downloading malware filled attachments or clicking on links tainted with malware.

Reproduced below is a new phishing email presently being circulated that is one of the worst examples of a phishing email.   It purports to be from the Apple Store informing the recipient that his or her account has been used to make a purchase and urges the targeted victim to download an attachment if they did not make the purchase.

As regular readers of Scamicide have seen, many of the phishing emails we have shown you over the years are quite convincing, however this particular email is so filled with indications that it is phony, it is hard to imagine someone falling for the scam although I am sure some people will do so.

The email address of the sender has nothing to do with Apple which is an early indication that this is a scam.  There is no logo that appears on the email and the email is not addressed to anyone in particular nor does it indicate an account number.  Finally, their are spelling errors and horrible grammatical errors throughout the email.

Here is a copy of the email that is presently circulating.

“[ApplePay] – iTunes was used to purchase in App Store on Macbook Pro 13
Date and time: 27 May 2017 10.32 hrs
Transaction: 7BA6818XL0333C2U
Order number: MQ3N7F0G8Q
OS: OS X 10.12.4
Browser: Safari
Location: New York, United States of America
If the information looks familiar, you can ignore this email.
If you have not recently purchased an article or in-apps apps on a MacBook Pro 13 “
With its appIe lD and thinking that your account has been accessed,
Please read our binding and follow the instuction to back up your account.
Best regards,
AppIe account department
Copyright @ 1998-2017. 2211 N 1st St, San Jose, CA 95131, USA. All rights reserved.”
TIPS
Whenever you get any email that attempts to lure you into downloading an attachment or clicking on a link, you should be skeptical and never consider doing so unless you have absolutely confirmed that the email is legitimate.  Also, look for telltale signs that the email is a phishing email by examining the address of the sender, the spelling and grammar and a lack of your account number or name appearing although in more professionally done spear phishing emails real account numbers and your name might be used which is why it is always imperative to never click on links or download attachments unless you are totally convinced that the email is not phony.

Scam of the day – May 4, 2016 – iTunes tax scam

I have been warning you for years about scammers posing as IRS agents demanding immediate payment of overdue taxes by credit card,  prepaid debit card or wired funds.    Often the scammers threaten their victims with criminal charges, deportation or loss of a driver’s license if a payment is not immediately made. However, in a new twist, the Treasury Inspector General for Tax Administration has recently issued a warning that the scammers are now demanding payment for these phony overdue taxes by way of iTunes gift cards.

TIPS

This scam is easy to spot.   The IRS will never initiate communications with a taxpayer by phone so if someone calls you purporting to be from the IRS in an initial effort to collect overdue taxes, you should hang up because it is a scam.   Even if your Caller ID appears to show that the call is from the IRS, this does not mean that the call actually is from the IRS.  Through a technique called “spoofing” a scammer can make the call appear to be legitimate, but it is not.  The IRS will never demand payment by credit card, debit card, cash card or wired funds through an initial telephone call.   Nor will the IRS EVER demand that payment be made by way of iTunes gift card or any other gift card. If you think that you really may owe taxes, call the IRS at 800-829-1040 to speak to a real IRS employee.  If you receive a scam call, you may wish to report the call to the Treasury Inspector General for Tax Administration at 800-366-4484.

Scam of the day – September 28, 2015 – New iTunes phishing scam

Today’s Scam of the day comes right from my own email account although many people are reporting receiving the same email.  It appears to be from iTunes and indicates that in order to continue to use iTunes, I must verify information in my account.  The email is a scam and works in one of two ways, both of which are bad.  In one scenario if you click on the link to provide information, you will be turning over your personal information to an identity thief who will use the information to make you a victim of identity theft.  Even worse is the other possible scenario which is that when you click on the link, you will unwittingly download a keystroke logging malware account that will permit the identity thief to steal all of the information on your computer and use it to access your credit cards, bank accounts and other financial accounts and use that information to make you a victim of identity theft.  This particular email which is reproduced below contains a number of clues that it is a scam.  Often these emails come from botnet zombie computers that have been hacked into to send out these emails and so the email address from which it was sent will not have anything to do with Apple or iTunes, but will carry the address of the unfortunate person whose email was hacked and taken over.  In my case, the email was sent by a non-business account in the United Kingdom  Also, although it is easy to copy logos, identity thieves, particularly when they are from foreign countries do not use proper grammar or proper English.  For instance, in this email the word “cooperation” is spelled incorrectly.  Finally, the email is addressed merely to “Dear iTunes User” instead of using my name in the salutation thereby indicating that this is being sent out widely to many individuals rather than sent merely to people to whom it would apply if it were legitimate.

Here is a copy of the email I received.  DO NOT CLICK ON THE LINK.

“Dear iTunes User,

Your account requires verification due to our recent upgrade. It is mandatory that you confirm your details through our secure link below.

Connect

Thank you for your co-operation.

Sincerely Yours,

iTunes Admin
Copyright © 2015 Apple Inc. All rights reserved”

.

TIPS

Never click on a link unless you are absolutely sure that it is legitimate and unfortunately whenever you receive an email or a text message with a link, you cannot be sure that the message is legitimate.  Many times you will receive emails or texts such as this purporting to be from companies that you do not even do business with and you obviously can ignore these.  But if you have any concerns that the email might be legitimate, you still shouldn’t click on the link.  Instead you should call the particular agency or company at a telephone number that you know is accurate to inquire as to whether the email or text message was legitimate.  Chances are that you will find out that it is a scam.  Once, I received a large invoice from a company with which I do business for goods I did not order, but rather than click on the link provided in the email, I went directly to the company’s website to question the invoice.  When the website came up, the first thing I saw was a large announcement that the invoice was a scam and that many people had received these phony invoices.  If I had clicked on the link, I would have become a victim of identity theft.

Scam of the day – May 24, 2014 – iTunes phishing scam

Phishing is a common start to many scams.  Phishing occurs when you respond to an email that appears to be from a legitimate company with which you do business only to learn that the official looking communication was a counterfeit, the sole purpose of which was to lure you into clicking on a link that in turn either, unknown to you, downloaded a keystroke logging malware program on to your computer by which the scammer is able to steal all of the information from your computer and use that information to make you a victim of identity theft or to lure you into providing personal information that also is used to make you a victim of identity theft.  Many large scale scams, including the Target hacking often start when employees are victimized by phishing scams that in turn give the scammers access to the information in their companies’ computers.

A recent phishing scam that is going on at this time involves a phony email that appears to be from Apple telling the victim that his or her iTunes account has been improperly accessed and that the account is now locked.  In order to access the account the victim is told, he or she is required to provide information that ends up being used to make the phishing victim a victim of identity theft as well.

TIPS

Remember my motto, “Trust me, you can’t trust anyone.”  Never provide information in response to an email, text message or telephone call you receive unless you have absolutely confirmed that the communication to you is legitimate and there is a legitimate need for providing that information.  If you receive such an email, do not click on any links contained within it, but rather call the company at a telephone number that you know is accurate to find out whether or not the original communication to you is legitimate or not.