Archive. This is an archive of the Apple Support Community. Discussions are being restored and soon you will be able to read and post here again.

Apple Platform Security Message

I am receiving a message on my iPhone screen that says it is from Apple Platform Security. The message is

"The security system has detected wiretapping on your Apple iPhone. Run a file check on your device." Then there is a RUN A TEST button.


Is this real or a scam?

8 replies

Hello~ This is a scam. Just scammers doing what scammers do. Report it, delete it or both and move along with your day. Don’t interact with any scam messages at all…period. I treat any unfamiliar message as a scam until I can prove otherwise…sad but true.



See below…


Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support



~Katana-San~

Go with what Niel said. In particular don't trust any message which has you click on anything in the message unless you are positive it came from Apple.


Criminals are getting very good at imitating Apple messages (or in your case one that sounds patently false). Start here about recognizing phishing and scams —> Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support


Read this article about identifying real App Store and iTunes Store emails --> Identify legitimate emails from the App Store or iTunes Store - Apple Support Sometimes the only indication in a communication is very subtle. Have a look at this thread. Someone registered an Apple ID with my em… - Apple Community It can be very hard to tell from a communication alone if it is authentic. The best way to check is to use an independent way through Apple's own resources to confirm what the communication claims. Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. These support articles have some guidelines:


More information about scams:

Apple Cash --> Avoid scams when you use Apple Cash - Apple Support

Gift Card Scams --> About gift card scams - Apple Support


If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Use an actual apple.com resource to independently verify what the message is claiming, or use an Apple device feature such as Settings or an Apple app. To ask Apple, start at this web page: Official Apple Support If you wish to investigate links, this post by contributor MrHoffman describes how you can do that —> "Keep your Apple Account safe and secure"… - Apple Community (the link takes you to the end of the post so scroll up a bit).


- Do a web search for any telephone number being provided. See if it is listed on an actual real apple.com web page as a contact method.

- Apple won’t warn you about disabling an account. You will find out when you try to sign in.

- Phishing emails may include account suspension or similar threats in order to panic you into clicking on a link without thinking. They may report a fake purchase in order to infuriate you into rashly clicking on a false link to report a problem.

- Apple e-mails address you by your real name, not something like "Dear Customer", "Dear Client", or an e-mail address* However, having your actual name is not proof this isn’t phishing. Compromised databases may have your name and address in them.

- Apple e-mails originate from @apple.com or @itunes.com but it is possible to spoof a sender address. "Apple email related to your Apple ID account always comes from [email protected] ." (From an older version of: About your Apple Account email addresses - Apple Support )

- Set your email to display Show Headers or Show Original to view Received From. Apple emails originate from IP addresses starting with "17.".

- Mouse-over links to see if they direct to real Apple web sites. Do not click on them as this just tells the spammer they have a working e-mail address in their database. If you are unsure, contact Apple using a link from the Apple.com web site, not one in an email.

- Apple will not ask for personal information in an e-mail and never for a social security number.

- Scams frequently have bad grammar or spelling mistakes. They may sounds too “folksy”.

- Apple will not phone you unless it is in response to a request from you to have them call you.


* Exception: I got email saying my ID is expired! Does… - Apple Community


“If you receive a suspicious link to a FaceTime call in Messages or Mail, email a screenshot of the link to [email protected]. The screenshot should include the phone number or email address that sent the link.”


Forward email phishing attempts as an attachment (in MacOS Mail use the paperclip icon) to: [email protected] then delete it.


Here is how Apple presents their threat notifications, particularly the one shown at the top of Settings, and shown at the top of your Apple Account web page:




Above from: About Apple threat notifications and protecting against mercenary spyware - Apple Support






As for the “wiretapping” advert you are reading right now — yes, this ‘wiretapping’ message is an advertisement — local apps can’t scan your iPhone, much less can a remote website.


Nor can remote websites remotely detect “eavesdropping”, as the connections are encrypted. Your network traffic simply isn’t routed via that remote website.


The whole “wiretapping” popup is an advertisement that is too often for an app you don’t need that badly solves a problem you don’t have and that hasn’t existed for a decade or more (a “pinky promise” VPN), but these “pinky promise” VPN apps badly solves the no-longer-existent problem in a way perfect for data collection.


A “pinky promise” VPN app is perfectly placed to eavesdrop, and quite possibly (as a well-known Mac anti-malware app did) collect your personally-identified web browsing activities and online purchasing activities and then resell that info, once the app is installed.





TL;DR:


Check Settings, and check the account.apple.com website, if you are at all unsure.


Then dismiss this popup advertisement, and continue with the rest of your day.

It's a scam. Apple can't check units unless a file is manually uploaded to their servers, or the unit sent to them.


(265287)

As stated above, it's a scam. That's not an Apple website, and any actual wiretapping would be done through a carrier's systems, not Apple's.


(265289)

Saegzz wrote:
Can you send screen shot? Hopefully you didn’t click on it

We don't need to see a screenshot to know it was a scam.

Can you send screen shot? Hopefully you didn’t click on it

Here is the scan.


[Edited by Moderator]