Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I own "mydomain.com" (actually something else!) and have a catchall to receive all emails sent to any xxxx@mydomain.com Earlier this week I received an email from appleid@id.apple.com asking me to verify annepearson@mydomain.com. This person is unknown to me. I did not verify.

I have now received this email: Dear Anne Pearson,

The password for your Apple ID annepearson@mydomain.com has been successfully reset.

If you believe you have received this email in error, or that an unauthorized person has accessed your account, please go to iforgot.apple.com to reset your password immediately. Then review and update your security settings at appleid.apple.com >

Has this person succesfully greated an account with an email address she doesn't own?

If so, what can I do?

share|improve this question
add comment

4 Answers 4

I think this may be a phishing. I advise you to check the 3 following key points:

  1. Within the headers of the 2 E-mails you received, verify they are really originating from apple.com .
  2. Verify the included URL is really within the apple.com domain.
  3. Within the headers, verify there isn't any Return-Path: outside of apple.com .
share|improve this answer
    
Very concise and very good advice - +2 if I could vote twice. (so it looks like it will have to be +100 once I can award the bounty) –  bmike Dec 29 '12 at 14:59
add comment

Has this person succesfully greated an account with an email address she doesn't own?

I don't think you can say they successfully created one, as they will never be able to use the email to verify anything sent to it from Apple. Most likely they just accidentally entered your domain name. Is it similar to another more popular domain name? A one off typo?

If so, what can I do?

Smile and imagine how perplexed they are that they never get the verification emails Apple tells them they are sending. They have not taken anything from you or done anything to you. Therefor, there is nothing for you to do.

share|improve this answer
    
Gosh - replies are amazingly fast here! Yes i have already mentioned that - my mistake I just received another email and thought it was proof that they had successfuly created an account - apparently not? –  Bob Steen Nov 25 '12 at 16:07
add comment

Everything looks to be explainable by someone using your email address as the string for their Apple ID.

This could be an innocent mistake or them wanting you to perhaps consider selling your domain to them by them squatting on your name space for Apple's iCloud service / Apple ID service.

If you don't even plan to use Apple's products or this email address you could simply ignore all the emails - make a rule and just never confirm any account that tries to use that email.

The "what can I do" boils down to if you care if they have an account with Apple using your email? You could fight it, but it will take some time and perhaps writing a letter to Apple to clear things up.

As long as you don't verify that email - it won't work for that person and they will need to provide another email to use that Apple ID. They will have squatted on that AppleID but nothing else. Apple uses a two step email verification process to ensure that someone doesn't accidentally or intentionally get an email that they do not control listed for an Apple ID.

You could also log in and take control of that account but I've not seen Apple spam unverified email accounts and that person will likely tire of manually logging in and sending verification emails to an account they don't control. More likely, they will delete that email from the Apple ID and move on.

share|improve this answer
    
If "Apple uses a two step email verification process to ensure that someone doesn't accidentally or intentionally get an email that they do not control listed for an Apple ID" then how did they get the account linked to that address in the first place? I'm assuming that you need an existing account before you can get a password reset email sent for that account. –  octern Nov 25 '12 at 6:20
    
No - when you create an Apple ID - you can enter any string that isn't taken. I could make a new Apple ID using bmike@BobSteenPizzaKing.com and enter that as a verification email. Apple then sends the verification to ensure that the email not only works, but that the owner agrees to the use. The only check Apple makes is if someone else already is using that exact email or that exact Apple ID. It doesn't care if the domain is registered or determining who actually owns it. –  bmike Nov 25 '12 at 14:18
    
I've now received this email from Apple - Your Apple ID password has been reset" - Dear Anne Pearson, The password for your Apple ID annepearson@mydomain.com has been successfully reset. If you believe you have received this email in error, or that an unauthorized person has accessed your account, please go to iforgot.apple.com to reset your password immediately. Then review and update your security settings at appleid.apple.com > I didn't reset it - Should I now be concerned? –  Bob Steen Nov 25 '12 at 16:02
    
You mentioned that in the question. If this is the only email address on that account you might have to deal with them emails or Apple to clear up ownership of this one account. –  bmike Nov 25 '12 at 16:05
    
I see. So, if the person is able to reset the password without verifying the account, then the domain owner could have gotten both of those emails (the verification request and the password reset message) without the owner of the account ever having successfully received an email sent to that address. –  octern Nov 25 '12 at 20:44
add comment

Most likely you answered your question in the very first sentence of your question, and the likely answer is that such email address doesn't exist. Typically catch-alls catch only messages sent to non-existing email addresses at the domain. If your catch-all is configured that way (and that's the default setup for all email services that I've seen), the fact that the email message ended up in the catch-all mailbox means that no such email address exist.

As for the source of that email message -- it was already suggested that either somebody mistyped it or is some kind of phishing attempt.

If your catch-all mailbox catches all emails received at the domain, even the ones sent to legitimate email addresses, that's another story (I haven't seen such setups, but they are possible). In that case, it is not clear if such an email address exist. To check, disable the catch-all, send email to the email address and see if it bounces.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.