Apple and iCloud scam texts: fake security alerts, Apple Pay charges and how to check

What these texts look like

Apple's scam guidance, published on 22 June 2026, describes the pattern. The message or call says your iPhone or iCloud account has been hacked, or that Apple Pay charges you didn't make have gone through, and offers to help you stop it. It pushes you to act at once, and sends you to a fake page that looks like Apple's sign-in page, where you are asked to prove who you are. Apple warns that scammers may already know things about you, such as your address or where you work, to seem genuine.

What Apple says it will never ask you to do

The follow-up call from ‘Apple Support’

Apple says scammers spoof caller ID, so a call can appear to come from a real Apple number, and that the answer to an unexpected call from ‘Apple’ or ‘Apple Support’ is to hang up. If you need Apple, contact it yourself through its official support channels.

Check your Apple Account without the link

On an iPhone, open Settings and tap your name: that is your Apple Account. Scroll down to see every device signed in to it, and remove any you don't recognise. Without an Apple device, Apple says to sign in at account.apple.com, typed into your browser, and select Devices.

If you typed your Apple password

Report it

• A fake Apple text: take a screenshot and email it to reportphishing@apple.com, as Apple asks.
• If it came as an ordinary text (a green bubble on an iPhone), forward it to 7726, free on most networks.
• If it came as an iMessage (blue), tap Report Spam under it. Apple notes: “Reporting spam doesn’t prevent the sender from sending messages.” So block the sender as well: iMessage and RCS scams.

If money left your account

Tell your bank straight away, on the number on your card. Then report it as a crime: in England, Wales and Northern Ireland to Report Fraud at reportfraud.police.uk or on 0300 123 2040; in Scotland to Police Scotland on 101.

Got an Apple verification code you didn't ask for? Someone typed your details into a sign-in page; never pass the code on: verification code texts. Paste any message into the scam text checker to see its red flags.

Sources

• Apple, what Apple never asks (22 Jun 2026): Apple Support, 'Recognise and avoid social engineering schemes including phishing messages, phony support calls and other scams' (published 22 June 2026): "Apple will never ask you to log in to any website, or to tap Accept in the two-factor authentication dialogue" Short quote; the rest is summarised in our own words. — https://support.apple.com/en-gb/102568, read on 2026-10-02
• Apple, scam signs and reporting, in brief: Apple Support, 'Recognise and avoid social engineering schemes including phishing messages, phony support calls and other scams' (published 22 June 2026), summarised in our own words: Apple says it never asks you to sign in to a website, to tap Accept on a two-factor authentication prompt, to hand over your password, passcode or two-factor codes, or to switch off protections like Stolen Device Protection or two-factor authentication; a sign of a fake message is a sender email address or phone number that doesn't match the firm named in the message; scammers may spoof Apple's phone number, claim your iPhone or iCloud has been hacked or Apple Pay used without you, and send you to a fake sign-in page; if you entered your password on a scam site, change your Apple Account password at once and make sure two-factor authentication is on; hang up on unexpected calls claiming to be Apple; don't pay other people with Apple Gift Cards; report a fake Apple text by emailing a screenshot to reportphishing@apple.com. — https://support.apple.com/en-gb/102568, read on 2026-10-02
• Apple, devices signed in to your account: Apple Support, 'Review devices signed in to your Apple Account' (published 15 September 2026), summarised in our own words: on an iPhone, open Settings, tap your name and scroll down to the list of devices using your Apple Account; tap one you don't recognise and choose Remove from Account; without an Apple device, sign in at account.apple.com and select Devices. Devices on the list can, depending on type, change your password and receive two-factor codes. — https://support.apple.com/en-gb/102649, read on 2026-10-02
• Apple, what reporting spam does (iOS 27): Apple, iPhone User Guide (iOS 27), 'Report spam and block senders in Messages on iPhone': "Reporting spam doesn’t prevent the sender from sending messages." Short quote; the rest is summarised in our own words. — https://support.apple.com/en-gb/guide/iphone/iph3f94d910d/ios, read on 2026-10-02
• NCSC, if you gave out a password: NCSC, 'Phishing scams: If you've shared sensitive information' (published 26 November 2021, reviewed 5 September 2022), 'You've given out your password': "You should change the passwords on any of your accounts which use the same password. If available, you could use a passkey instead." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/what-to-do, read on 2026-10-02
• NCSC, if you've shared sensitive information: NCSC, 'Phishing scams: If you've shared sensitive information' (published 26 November 2021, reviewed 5 September 2022): "You’ve provided your banking details: Contact your bank and let them know. ... You've given out your password: You should change the passwords on any of your accounts which use the same password. ... You've lost money: Tell your bank and report it as a crime to Report Fraud (for England, Wales and Northern Ireland) or Police Scotland (for Scotland)." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/what-to-do, read on 2026-10-02
• NCSC, where to report a loss: NCSC, 'Report a scam text' (published 26 November 2021, reviewed 5 September 2022), 'If you've responded to a scam text message': "In England, Wales or Northern Ireland, visit https://www.reportfraud.police.uk/ or call 0300 123 2040. In Scotland, report to Police Scotland by calling 101." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-10-02
• NCSC, how to spot a scam: NCSC, 'How to spot a scam email, text message or call' (published 26 November 2021, reviewed 5 September 2022): "Urgency Are you told you have a limited time to respond (such as 'within 24 hours' or 'immediately')? Criminals often threaten you with fines or other negative consequences. ... If you have any doubts about a message, contact the organisation directly. Don’t use the numbers or address in the message – use the details from their official website." Contains public sector information licensed under the Open Government Licence v3.0. — https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams, read on 2026-10-02
• NCSC, forwarding to 7726: NCSC, Report a scam text: "Most phone providers are part of a scheme that allows customers to report suspicious text messages for free by forwarding it to 7726. If you forward a text to 7726, your provider can investigate the origin of the text and arrange to block or ban the sender, if it's found to be malicious." — https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message, read on 2026-09-29

Quotes from GOV.UK, legislation.gov.uk, mygov.scot, the NCSC, the ICO and NHS England are used under the Open Government Licence v3.0; material from Ofcom is Ofcom copyright. Other pages are summarised in our own words or quoted briefly, with a link. How we check.