A text says your Apple Account is locked or you must verify something. Here's how to check it using what Apple says it does and doesn't do, and what to do if you tapped.
A text says your Apple Account is locked, your iCloud storage is full, or a purchase was just made, and a link will fix it. Apple's own guidance on phishing and fake support is clear about what Apple does and doesn't do, and that makes these messages easy to check. Here is how to tell a real Apple message from a fake one, using what Apple says on its support page. (Apple Support)
Got a message like this? Check it in seconds.
Check it with ShieldrShort version: Apple doesn't ask you to log in to a website or give up a password or code over text, so a text that does is not Apple.
Apple lists the signs of a phishing email or text, and a fake “Apple” message tends to hit several at once: the sender's phone number or email address doesn't match the company, a link looks right but its real destination isn't an Apple site, the message looks different from Apple's usual messages, and it asks for personal details such as a card number or account password. (Apple Support) A message might read like this:
The link leads to a page built to look like an Apple sign-in. If you type your password or the code Apple sends you, the scammers can use them on the real sign-in page.
Apple doesn't ask for your Apple Account password, verification codes or device passcode to give you support. Apple's page says it never asks for this information to provide support, and that it won't ask you to log in to a website, approve a two-factor prompt you didn't start, or turn off security features such as two-factor authentication or Stolen Device Protection. Apple also says it won't ask you to pay with Apple Gift Cards. (Apple Support) A message that wants any of those is not from Apple, whatever the sender name says.
Apple adds a rule worth keeping: if you're unsure, assume it's a scam and contact the company directly through its official channels. (Apple Support)
Apple's guidance: if you may have entered your password on a scam site or your Apple Account may be compromised, change your Apple Account password right away and make sure two-factor authentication is on. (Apple Support) Beyond that, the FTC's advice depends on what you gave away: (FTC)
Share the text, email or screenshot to Shieldr. It reads the message, checks any link against Google's list of known malicious sites, and answers safe, suspicious or scam with a one-sentence reason. It's one more check before you tap anything, not a guarantee: Settings on your own iPhone is always the final word.
Get Shieldr on the App StoreApple says it doesn't ask for your Apple Account password, verification codes or device passcode to provide support, and it won't ask you to log in to a website. A text that asks you to verify through a link is a reason to check your account yourself in Settings and report the message.
Apple says to take a screenshot of the text and email it to reportphishing@apple.com. In the Messages app you can also tap Report Junk under the message and block the sender. Forward it to 7726 (SPAM) and report it at ReportFraud.ftc.gov too.
Apple says to change your Apple Account password right away and make sure two-factor authentication is on. If you gave a card number or gift card codes, contact your card issuer or the gift card's issuer.
Related: is that Amazon text real?, is that Chase text real? and the fake product recall text scam.
Shieldr is not affiliated with Apple. Apple is a trademark of Apple Inc.