The “Apple Pay” alert isn’t the scam. The number it wants you to call is.
You’ve trained yourself well. A text shows up about your account, there’s a link, and you don’t tap it. That instinct has kept you safe for years.
This scam was built for people exactly that careful. It skips the link entirely. All it needs is for you to pick up your phone and dial.
If a message about your money hands you a number to call, the message is the scam.
It starts as something dressed up like an Apple Pay fraud alert: a text or an email saying a payment was attempted, or your account is locked, or it’s under review and you need to act right now. Sometimes there’s a link. But the part doing the real work is the phone number at the bottom, the one offering to “resolve the issue.”
Why the call is the dangerous part
Call that number and you reach a person trained to sound like Apple Support, or your bank, or even the police — never Apple itself. By the time you’re on the line, they often already know a few real details about you, just enough to sound official. Then the pressure starts: your money is at risk this minute, and you have to move fast to protect it.
The hurry is the whole point. It keeps you from doing the one thing that would end the con, which is hanging up and checking your account for yourself.
ConsumerAffairs documented one woman who was talked all the way to the bank counter, ready to withdraw $15,000, before a teller stopped her and asked what was going on.
Notice what your security software did during all of that. Nothing. No app can stop this, because nothing on your phone gets hacked. You hand the money over yourself. That’s what “social engineering” means in plain terms: the trick is aimed at you.
The lines that always give it away
Whatever story they spin, the ask always lands in the same few places. Any one of these means you’re talking to a scammer, full stop:
- They tell you to move your money to a “safe” or “secure” account. The FTC is blunt about this: no real bank or agency will ever ask you to do that.
- They want payment in gift cards, or ask you to read the numbers off the back of one. Apple states plainly that it will never ask you to pay this way.
- They ask for your password, your device passcode, or a verification code texted to you. Apple will never ask you to share a two-factor code or type it into a website.
- They tell you to withdraw cash and hand it off, or to lie to your bank teller about why you’re taking it out.
The one rule that beats every version
Never call a number, and never tap a link, that arrived inside the message itself.
If you’re worried the alert might be real, don’t use anything in it. Open your Wallet app and look at your account directly, or call your bank using the number printed on the back of your card. A real problem will still be there when you check on your own. A fake one disappears the moment you do.
If you already called
If you already picked up, or already shared something, act now rather than later:
- Hang up and stop talking to them.
- Call your bank using the number on your card and tell them exactly what happened.
- If you gave up a password, change it immediately. If you shared a verification code, treat the account as exposed and secure it right away.
- Report it to the FTC at ReportFraud.ftc.gov.
The best protection here is the half-second pause before you act, and nothing you can buy will do it for you. Scammers live on urgency. Slow down, hang up, and check it yourself, and the whole thing falls apart.