Yes. This is a documented scam pattern. Scammers embed a fake phone number in an Apple ID name field, triggering a real account-change email from appleid@id.apple.com about a fake purchase. Calling the number reaches scammers who steal your Apple ID or drain your bank.

What are the red flags of this scam?

The email genuinely comes from appleid@id.apple.com — scammers exploit this to make it look real, but a legitimate Apple account-change email never includes a dollar amount or a customer service phone number in the body • The salutation is 'Dear User' or a garbled sentence rather than your actual name — scammers write their phishing payload into the name field, so your name is replaced by the scam text • The email tells you to call a phone number to cancel a purchase — Apple never puts a support phone number inside an account notification email • The purchase amount seems alarming ($699–$1,200 range) and tied to PayPal, which you would not use to buy an Apple product directly • No purchase appears in your actual order history at appleid.apple.com or in the App Store purchase history on your device • The caller asks for your Apple ID verification code (sent to your phone by Apple) — giving it hands over your account instantly • The caller wants you to install AnyDesk, TeamViewer, or another remote-access app to 'process the refund' or 'secure your account'

What should I do if this happened to me?

Do not call the number in the email — Apple's account notification emails never include a support phone number for purchases • Go directly to appleid.apple.com (type the URL yourself) to verify whether any real changes were made to your account • If you see an unfamiliar change, remove any devices you don't recognize under Sign-In and Security → Trusted Phone Numbers • If you called the number and gave them a verification code: immediately change your Apple ID password at appleid.apple.com and sign out all other sessions — the scammer may already have your account • If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it. • Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

HIGH phishing Last reported: Oct 3, 2026 Share

Email from Apple's own servers claims an iPhone was purchased and gives a number to call

Scammers embed a fake phone number in an Apple ID name field, triggering a real account-change email from [email protected] about a fake purchase. Calling the number reaches scammers who steal your Apple ID or drain your bank.

Also known as: Apple account notification phishing, fake Apple purchase email, Apple ID name field phishing, appleid email scam, Apple server phishing

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.

What to do right now

1 Do not call the number in the email — Apple's account notification emails never include a support phone number for purchases
2 Go directly to appleid.apple.com (type the URL yourself) to verify whether any real changes were made to your account
3 If you see an unfamiliar change, remove any devices you don't recognize under Sign-In and Security → Trusted Phone Numbers
4 If you called the number and gave them a verification code: immediately change your Apple ID password at appleid.apple.com and sign out all other sessions — the scammer may already have your account
5 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
6 Report to the FTC at https://reportfraud.ftc.gov and the FBI's IC3 at https://www.ic3.gov.

Was remote-access software installed?

If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.

Run SeraphSecure to detect and remove it →

Red flags

⚠ The email genuinely comes from [email protected] — scammers exploit this to make it look real, but a legitimate Apple account-change email never includes a dollar amount or a customer service phone number in the body
⚠ The salutation is 'Dear User' or a garbled sentence rather than your actual name — scammers write their phishing payload into the name field, so your name is replaced by the scam text
⚠ The email tells you to call a phone number to cancel a purchase — Apple never puts a support phone number inside an account notification email
⚠ The purchase amount seems alarming ($699–$1,200 range) and tied to PayPal, which you would not use to buy an Apple product directly
⚠ No purchase appears in your actual order history at appleid.apple.com or in the App Store purchase history on your device
⚠ The caller asks for your Apple ID verification code (sent to your phone by Apple) — giving it hands over your account instantly
⚠ The caller wants you to install AnyDesk, TeamViewer, or another remote-access app to 'process the refund' or 'secure your account'

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Sources