iPhone users have been warned not to answer calls from Apple unless they have specifically requested one using the official Apple online support page. This comes off the back of a rash of spoofed support calls that have become increasingly sophisticated in their efforts to get access to Apple iCloud accounts. How sophisticated? How does displaying the Apple logo, address, and correct support telephone number grab you? Here's what you need to know.

The scam

The telephone calls are straightforward phishing, the same as you will have seen countless times in your email no doubt. They have more success because most people still aren't expecting a voice to be used in such social engineering scams. The scammers employ caller-ID spoofing techniques so as to impersonate the real telephone number of the service they claim to be representing. Most commonly as far as this particular threat is concerned that will be Apple support, although I have been told by those on the receiving end of such calls that AppleCare and Apple customer service have also been used in an attempt to gain the trust of the victim.

By spoofing that number and displaying the Apple logo, the fraudsters hope that the person answering the call will be less suspicious than if they were taking an unsolicited call from a number they didn't recognize. This kind of brand recognition leverage is high on the phishing 101 lists of ways to garner victim trust. It's why telephone scams supposedly from Microsoft support, which don't have the same trust-enhancing methodologies, tend to be less successful. As the fact-checking site, Snopes confirms, "if the recipient is an iPhone user who then requests a call back from Apple's legitimate customer support web page, the fake call gets indexed in the iPhone's recent calls list as a previous call from the legitimate Apple Support line."

The bait will vary but is always going to be a variation on the theme of your account has been compromised, there's been a data breach or there has been suspicious activity in your iCloud account. The latest bunch of these calls have been automated with a message informing the user to call a number that purports to be Apple support, complete with estimated waiting times and convincing welcome messages and call purpose options. Sometimes the user will be asked to "press 1" to connect to a support advisor. In all cases, the danger to your data story will be spun out and you will be asked to confirm your iCloud account credentials.

What Apple says

The Apple support presence on Twitter is, unsurprisingly, getting regular tweets from concerned iPhone users who have received such a call and want to know if it is genuine and their accounts have been compromised. The response is almost always the same: "Your security is our number one priority. You can find more information about phone calls and learn how you can report them by following the steps from this article here."

Source: Forbes