An e-mail purporting to be from Apple alerting users to a billing problem is, in fact, a phishing scam that’s targeting users of Apple’s online service, Macworld has learned.
The e-mail, forwarded to Macworld by a reader, looks like an official communication from Apple regarding MobileMe, the company’s subscription service that provides users with a personal e-mail address, Web hosting, file sharing capabilities, and online data synchronization between Macs, iPhones, and other devices. The e-mail states: “We were unable to process your most recent payment. Did you recently change your bank, phone number or credit card?” Users are then invited to click on a link to enter that information—but that link opens a Web page in your browser that does not appear to be affiliated with Apple or MobileMe (the other links in the e-mail do point to pages on Apple’s official Web site).
A check of the link information reveals that it is registered to a personal Gmail account originating in Bacau, Romania. It is unknown at this time if this is the person who sent the e-mail, or if their identity had been “spoofed” by the phisher.
In phishing scams, crooks send a phony, official-looking e-mail that tries to entice recipients into revealing private information such as passwords, social security numbers, or credit card and banking account data.
This isn’t the first instance where a phisher has tried using an Apple-run service to trick users. In May, iTunes Store users began receiving e-mail that appeared to be from Apple’s iTunes Store, suggesting that they must correct an apparent credit card problem. The phony page users were directed to asked for a credit card number and other personal information that, once revealed, could be easily exploited by malicious users looking to commit identity theft.