20

Begin forwarded message:

From: ID Report <childaviintlteknic59@substemptauthsvcstld.com>
Date: February 15, 2019 at 9:20:10 AM EST
To: [Bla bla bla <my email address>]
Subject: [TBA] Your account has been temporarily disabled for security reason!


Dear [Bla bla bla <my email address>],

Your Apple ID was used to sign in to a new web browser.

Date and Time : Friday, February 15, 2019
IP Address : 79.171.55.205
Country : Albania

Your Apple ID has been temporarily disabled for security reason.
When you see this alerts, you can go to iforgot.apple.com to unlock your account with your existing password.
Your account will permanently disabled if you do not verify your account under 24 hours.

Sincerely,

Apple Support

Apple ID45 | Support | Privacy Policy
Copyright © 2018 All Rights Reserved 
  • Comments are not for extended discussion; this conversation has been moved to chat. – nohillside Feb 18 at 15:07
  • 4
    The easiest way to tell this is fake is to look at the very fist line. It's from an email at @substemptauthsvcstld.com, not @apple.com – Jon Feb 19 at 1:23
  • @Jon : don't forget that the vast majority of users will only see "ID Report" as the sender of this kind of fraud because they use a stupid E-mail software hiding the truth. – dan Feb 20 at 18:29
51

Even without posting the headers or any hyperlinks in the message, it's easy to identify a message like that as a bogus message. Note the poor use of English ("see this alerts") and the creation of the sense of urgency ("permanently disabled if"). There is also almost certainly a bogus hyperlink for iforgot.apple.com in the message which would lead to a website that was designed to scare you into supplying your credentials to the scammer.

  • 4
    Even better would be if the fake login site intentionally refuses a few logins, prompting the phished user to try again a few more times. Whether that is because they might have typo'd, or because they think they may have used a different password, it's in the phisher's better interest to collect but refuse for a few attempts. – Nathan Young Feb 15 at 23:23
  • 4
    @AndrewT. The URL can look identical too using unicode characters. For example use a cyrillic а and instead of a latin a in аpple.com. To be sure that the page is correct you must open the SSL certificate details. – Bakuriu Feb 16 at 18:37
  • 3
    @Bakuriu does the ssl cert page help? They surely have a valid ssl certificate to latin a apple.com? – Richard Tingle Feb 16 at 23:09
  • 2
    @RichardTingle I feel like you have never opened the certificate help page, since the Organization is prominently displayed there. They will have a valid certificate issued to SnakeOil instead of Apple Inc. – Bakuriu Feb 17 at 8:50
  • 2
    @UKMonkey Yes, but you can also make a typo and the site redirects you. So to be 100% certain you have to take multiple steps including checking the certificate. Anyway if you include a compromised issuer as a threat than they can also just MitM the real site. You'd have to check the IP of the server against a list of known apple IPs too. And then an ISP may be compromised and alter BGP routes and whatnot. You have to decide where to draw the line in your threat model. – Bakuriu Feb 18 at 19:48
39

There are several signs to show this is fake:

  • Poor grammar

  • It doesn’t say your name but it says your email Dear [your email address]

  • The sent address. It doesn’t contain Apple.

  • iForgot is a site to recover your password not to log-in

  • Apple’s Privacy Policy is 2019 Copyright and not 2018

What I would do:

  • Log-in to https://appleid.apple.com check the status of your account and change your password

  • Not clicking the iForgot link in the email

  • Report the email as encouraged by Apple:

If you receive what you believe to be a phishing email that's designed to look like it’s from Apple, please send it to reportphishing@apple.com

  • 4
    Any email can say support@apple.com, this is a weakness of SMTP. The only domain that means anything is that on a valid and verified DKIM signature. – trognanders Feb 15 at 23:50
  • 3
    Sounds good except from the suggestion to change password. There isn't any evidence the account has been compromised yet, so there isn't a reason to change the password. All there is evidence to say is that the scammers know the email address, not the password. And at least for some people the email address is public knowledge. – kasperd Feb 16 at 19:22
  • 5
    Echoing @kasperd's point, I get hundreds of these scam messages a day and I'm not about to change my password every time I get one as there's no need. Scam/spam email addresses are often generated programmatically, too; just because you get an email doesn't mean anyone even has your email address. – fluffy Feb 17 at 1:48
  • @kasperd : you're absolutely right! – dan Feb 17 at 10:14
13

While others are focusing on the literal question of “Is this email legit?” I will be more direct, clear and universal:

Don’t Panic!

If you don’t trust an email you have received that says something like “your account has been hacked” then do not click any link on the email and just visit the official website of the account to check.

That’s it.

The reality is emails can be faked and phishing emails are getting more sophisticated. So instead of breaking your brain trying to comb through every supposed “sign” of a problem, instead do not ever panic when getting an email like this. Delete it—or at least don’t click on any link in it—and then just visit the website you got that email from and see what happens.

9 times out of 10 you will login without issue. If you still feel nervous, just change your password on the site and even enable two-factor authentication and you should be good to go.

But at the end of the day:

Hitchhiker’s guide to not panicking at phishing emails.

  • 1
    I would go further. If you have a financial relationship with the company never click on a link always type the url of the home page in your browser (or at least via a well known search engine) – user151019 Feb 16 at 11:57
  • 1
    This is the best advice for people who - no offense - did not immediately see that this is a phising EMail. – knallfrosch Feb 18 at 13:08
10

This is a fraud because the From: field is not from Apple:

From: ID Report <childaviintlteknic59@substemptauthsvcstld.com>

And I stopped any investigation there! (I modified the format of your original question so as to let everyone see this key detail.)

Beware, detecting a fraud isn't always that easy (for example a more intelligent criminal might have used this from field: From: Apple <noreply@email.apple.com>, and everyone can fight this case too, just make another pretty good question), but in any case you did 2 right things:

  • didn't panic,
  • ask to professionnals.

Please note: none of your password was stolen, hence you don't have to change it. Usually don't trust people telling you to change your password if they aren't able to explain you why in plain and simple english (because this is typical of criminal just trying to fool you).

  • 4
    You could clarify this to point out that if the From: field did say it was from Apple, that wouldn't be any guarantee that the email was legitimate, as it is trivial to fake a From: field. – Michael Geary Feb 16 at 20:36
  • @MichaelGeary: you're absolutely right. I wanted to make as simple as possible an answer on this case of stupid criminal to show that everyone able to read is able to fight against most of the phishing attacks. The ones who tell everyone otherwise are editors who need stupid consumers and fear dealers. – dan Feb 17 at 10:00
8

This is a poorly crafted forgery, and it makes our job easy when they make dumb mistakes like the above. but if the phisher had been more careful, those lines could have been flawless. Dumb errors are not a reliable spotting method - don't assume flawless emails are legit.

For an email with no errors, you would need to

  • Check the destination of the URL link. However, know how to recognize a real domain, don't be fooled by www.apple.com---update-id.cgi.weirddomain.net/22.
  • open up the "view source" or "full email headers" and look at the Received: lines, starting with the last one and working upward. Make sure it starts at apple.com and every "hop" makes sense. Sometimes a clump of Received: lines will be faked, and are split apart from the rest.

Really, the best strategy is just assume the email is bogus, don't click any links on it, and use it only as a "reminder" to check your account security by navigating in your browser to the relevant web page.

In fact, PayPal was so eager to train users to never click links in emails, for quite some time, they literally stopped putting any clickable links in their emails. They wanted you to know any PayPal email with a clickable link was bogus.

  • I do receive links on paypal emails. – Pedro Lobito Feb 17 at 1:36
  • @PedroLobito "For quite some time" this was their policy but they changed it in recent years for unknown reasons (but it's easy to speculate that maybe they wanted measurable clickthrough analytics or the like). – fluffy Feb 17 at 1:50
  • 1
    @PedroLobito me too lately... yeah, abolishing the email click was just one of those great ideas that was not going to last forever in a world of business managers with other priorities... – Harper Feb 17 at 4:28
  • @Harper : you are so right! what a shame (that PayPal decided to switch back to work for criminals by keeping consumers as stupid as possible). – dan Feb 17 at 10:07
3

In addition to the advice given, the following will do you in good stead.

If you place the mouse cursor on the link, but not click it, most systems will somewhere, usually in a status line, tell you the real destination of the link.

Alternatively, you will should be able to right click, then choose copy address link, to paste it in notepad etc, where you can determine its correct location.

  • I have seen webpages use javascript to change the URL once you click. So if you click the link you are taken to a different address than the one shown when you hover over the link. Whether you can get away with doing the same in an email I don't know, but I wouldn't trust what I see when hovering over the link. Copying the link to an editor to verify what it is and then after carefully verifying copying it from the editor to the address bare in a browser is indeed a safer way than to click it directly. This also allows removing any unwanted tracking information from the URL. – kasperd Feb 16 at 19:18
  • 1
    Also, for future reference for other people: the Mac equivalent of Notepad is called TextEdit. – SilverWolf Feb 17 at 1:41
2

It is a fraud email.

From: ID Report - childaviintlteknic59@substemptauthsvcstld.com

Notice the "From" section carefully. It is not from Apple. Also, the English is really poor in this email. The hyperlink "iforgot.apple.com" is a fake hyperlink. Don't panic. Do not open the link. Most likely the phisher is trying to fool you. Fortunately, he mustn't have been careful and made these mistakes.

  • The mail app might not have identified the mail as a spam. You can report the mail as a spam. – Rudra Feb 17 at 10:24
  • More specifically, you can go by whether the domain (substemptauthsvcstld.com) is a site you trust (and have had any contact with before). Extremely rarely will anyone want to receive a single email from a domain they have had no contact with. Any decade now, E-mail programs will remove faulty spam filters and go only by the domain name and always approve emails from people you have replied to... and above all, not hide the email From address... This last item must be an extremely high, if not the highest security risk for spreading viruses. Madness. – Henrik Erlandsson Feb 19 at 9:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .