What Is iforgot.apple.com Phishing Scam?

December 04, 2020

Before we start

Have you ever wondered what to do to get rid of annoying adware or malware caused by a scam email you’ve recently opened?

Download MacKeeper to check if your emails have been breached and remove the malware caused by a fraudulent email.

Have you recently received an email saying your Apple ID is temporarily blocked, just like that out of the blue? If you haven’t performed any actions and don’t even remember the last time you’ve logged in on a new device or browser with your Apple credentials—the best plan is to do nothing. This can lead to malware infecting your Mac, money, and data loss.

Read on to find out what iforgot.apple.com phishing scam is and how not to fall for such scam schemes.

Is iforgot.apple.com an official Apple email address?

Today, cybercriminals devise more and more sophisticated schemes luring Mac users to become their victims. Emails get hacked more often too. If you wonder if iforgot.apple.com is legit—the answer is yes with its official domain.

If you have an email from iforgot.apple.com in your inbox—make sure you are taken to the right webpage before you click any links from that email. If it’s a scam email—the url underlying the link leads you to a phishing site.

To see if it’s a phishing email:

Double-check the addresser’s email to make sure it was sent from Apple’s domain. Note: emails from Apple are “donotreply” ones
Hover over the iforgot.apple.com link, but do not click it. Make sure the link leads to iforgot.apple.com and not to a third party site

Keep in mind that Apple wouldn’t send you an email saying your account has been locked or threaten to disable your account forever, for no reason at all. Read on to learn how to detect if it’s a phishing scam.

appleid@id.apple.com phishing email scam

Another phishing email Apple users receive is the one using appleid@id.apple.com. How is it different from the iforgot.apple.com scam scheme?

Such emails claim an Apple user has created a new account. What is asked of the recipient is to verify their email address. What's the catch here? The recipient's name is wrong and untrue. Plus, if you decide to reply—you'll be able to do that. And it's a fact that legitimate Apple ID emails are "donotreply" ones.

What to do:

Report. If you've received such or other phishing emails looking like from Apple—forward them to reportphishing@apple.com
Don't take any action. Don't reply, follow links, or give your personal information
Check twice. It's never a bad idea to double-check what's in your inbox. Tip: Look closely at the original email headers

What does the iforgot.apple.com scam email exactly say?

At first sight, it might seem legit, but check for the following:

A message that your Apple ID was used to sign in on a new browser
Date, IP address, and some random country (usually, Albania or Russia)
A message: Your Apple ID has been temporarily disabled for security reasons. When you see these alerts, you can go to iforgot.apple.com
A clickable link to iforgot.apple.com
Strong suggestion to do this within the next 24 hours

IMPORTANT:

If your Apple ID is locked or disabled for real, you’ll be notified about this when logging in via pop-ups. Not via email.

What can the "iforgot.apple.com" scam email do to you?

Cyber thieves use the “iforgot.apple.com” scam scheme to steal your sensitive information, namely logins and passwords for Apple ID accounts. The fake website visually looks exactly like the Apple official website. However when you open it take a look at the address bar—it looks like a phishing site. The trick here is not to follow any email link and not give in any Apple ID credentials.

What can the cybercriminals do with your Apple sensitive data?

It’s not just a feeling that you’ve been scammed that comes along with this fake link. Your stolen sensitive information can be used to sign in to your iCloud account to access files, conversations in messages, and other data. Plus, cybercriminals can purchase using your money on the iTunes store.

How to remove iforgot.apple.com virus

What to do if you’ve clicked and followed all the “instructions” of the iforgot.com? Here’s plan B.

Step 1: Change password for your Apple ID

Delete the iforgot.apple.com email from your email account. You may also report this to Apple. Next, change the password.

macOS Catalina

Go to System Preferences—Apple ID—Password & Security
If asked—type your Apple ID password—then click "Forgotten Apple ID or password"—proceed with the instructions. Skip step 3 below
Choose Change Password. Before resetting your Apple ID password, you'll need to enter the password you use for unlocking your Mac

macOS Mojave, High Sierra, Sierra:

Open System Preferences—iCloud—Account Details
If asked—type your Apple ID password—click "Forgotten Apple ID or password"—proceed with the instructions. You can ignore the next steps
Choose the Security tab—click Change Password—type in your Mac admin password