The security, antivirus, and VPN company Malwarebytes has an interesting post on its Malwarebytes Labs blog detailing a new and sophisticated scam.
The web-based trick is meant to make users think that they just made a big payment with Apple Pay, with the goal being to trick them into calling a fake “Apple Support” number. That’s the real objective: Once they have you talking to a fake support agent, they’ll gather personal or financial info to actually take your money.
How it works
The scam uses a variety of web technologies to make it look, to the untrained eye, like an Apple Pay charge for $657 to the App Store has been made. There’s a fake Face ID animation, a padlock unlocking, a transaction ID, and a host of other cues that can fool many users into thinking the charge is real.
It then pops up a receipt and shows a large phone number to “call Apple Support” along with a View Details button. If the user taps the button, the web page plays an audio voice alert that says: “Unauthorized charge of six hundred fifty-seven dollars from your Apple ID. Please call support immediately.”
It’s all fake. It’s just web-based images, animations, and sounds. The amount and transaction ID are the same for everyone, and there was never any Face ID check or transaction attempted at all. The goal is to get the user to think that a big unauthorized charge was made, panic, and to call the fake Apple Support number.
If you try to hit the back button on your browser, a warning pops up that claims your “Apple ID session is active” (which isn’t a thing) and that leaving the page could expose your payments and banking info to serious threats. All of that is, of course, false.
Never call a popup number
If you happen to be on a web page and see this scam, the best thing you can do is open the tab view in your browser (the bottom-right button on Safari) and close the tab entirely.
Don’t tap on any of the dialog boxes or interface elements and definitely do not call the number.
As a matter of course, you should never dial a number in a popup or sent to you in a text message. No legitimate company will ever make a popup message with a phone number for you to call, and they will not text you a phone number unless you’re already in the middle of a support process with them and are expecting it.
