Unofficial archive. This is a read-only, community-run archive of the Apple Support Community. It is not affiliated with or endorsed by Apple Inc.
saridalsmash
User level: Level 1 (4 points)

Why someone can send phishing URL from Apple legitimite OTP sender ? And hack my credentials via phishing ?

Why someone can send Phishing URL from Apple OTP Sender ? And hack my credentials via phishing ?


Incident: October 27, 2026 | Pakistan

  1. My iPhone 12 Pro Max was stolen. I enabled Lost Mode and provided my friend's contact number.
  2. My friend received 3 phishing SMS messages between 7:30–8:00 AM PKT, appearing in the same SMS conversation as genuine Apple verification codes. (I attached screenshot with that phishing message)
  3. The link opened a fake Apple Find My interface showing my device name and a nearby location.
  4. It requested my Apple Account email, password, and stolen iPhone's passcode. I entered them.
  5. The website later returned 404 Not Found.

Phishing domain: ***


Questions:

  • How could phishing SMS messages appear under Apple's legitimate OTP sender identity?
  • What additional steps should I take to secure my Apple Account and stolen iPhone? (Other than i already changed password and removed device and phone number. because i have e-SIM that i shall disable from network provider also)
  • Can Apple investigate this SMS impersonation?
  • I need safety. My data is there in phone. can someone access that even when i changed iCloud password (They know my iPhone's password from that phishing. but i believe i quickly updated my password and they did not access iCloud account yet. i monitored emails also. none recieved) ?


I have screenshots and video evidence and have reported the phishing URL to Apple's phishing team.


These are phishing messages



These are earlier messages that proves it is actual Apple's OTP sender (I just used Figma to add rectangles for OTP. i do not want to share here as Apple says do not share with anyone.)



Yes I got tricked into believign a non "apple.com" URL is phishing URL. maybe i should have checked it earlier insetad of later. But Don't you think Apple has some sort of responsibility here ? Their OTP sender is sending phishign URLs. Why ? This is where I believed it. elsewise i suspected the URL a bit eralier as well.



[Edited by Moderator]

Posted on Oct 26, 2026 11:48 PM

3 replies

Limnos
User level: Level 10 (462,771 points)

Oct 27, 2026 3:51 AM in response to saridalsmash

It requested my Apple Account email, password, and stolen iPhone's passcode. I entered them.


When you gave the thief your password that opened up the pathway to your account which had one final hurdle and that was for Apple to request a OTP from you. The thief was fortunately blocked from this final stage but kept on trying.


Use the information in this article to check your Apple ID device list to find where you're signed in --> Review devices signed in to your Apple Account - Apple Support




Servant of Cats
User level: Level 9 (55,707 points)

Oct 27, 2026 6:56 AM in response to saridalsmash

saridalsmash wrote:
2. The link opened a fake Apple Find My interface showing my device name and a nearby location.
It requested my Apple Account email, password, and stolen iPhone's passcode1. . I entered them.
• I need safety. My data is there in phone. can someone access that even when i changed iCloud password


You told us that you entered your iPhone's passcode on the "phishing" site. So, even if your assumption that the criminals did not access iCloud (beyond what they needed to do to clear Activation Lock) is correct, the criminals have the passcode to your phone, and can use it to rummage through the data on the phone at will.

Originally posted at discussions.apple.com/thread/256383758