Plan B Forum

I received the following email this morning:

You signed in to your Apple ID, (my correct email.com) on 4/27/2017 12:50:32 AM GMT-4 (UTC) with the following details:

IP Address: 114.121.247.58
Country Code: IT
Browser/Device: Chrome 56.0.2924

If you initiated this sign-in attempt, you can ignore this message.

Didn't recognize this activity?
Please change your password and verify your account immediately by access this

https://appleid.apple.com/(I deleted this part for your protection)

To help ensure the security of your account, we will notify you every time we detect a sign-in. This link expire after 48 hours.

Regards,

Apple Support

P.S. To ensure maximum protection for your account, we disable your account

I've received similar notices after accessing iTunes from other computers, so this looked authentic for a second but then I realized it said someone logged in tomorrow and of course I immediately suspected that it was Gob...

Then there are a couple grammaticalization errors...

Just thought I'd pass this along because I'm always looking out for youse guys....

(I went to Apple's website and verified that no one had attempted to log in)

I get these occasionally, (I got one not to long ago that was supposedly from PayPal)

There are a couple of easy ways to spot these...

First checkout the actual "from" email address, not just the words you see when you look on the screen. just put your mouse cursor over the words, and you'll see the actual "from" address...

(The words may say "The Director of The FBI" but James Comey doesn't have an email address like "xztyuv@minsk.ru")

Second way is to put your mouse cursor over the link; if the legitimate business url doesn't show up, it ain't legit...

If you actually click on one of these spoof links, you will frequently see a page that looks exactly like what you would expect if you were on the actual website. This requires almost no technical skill to do; all they have to do is right click on the web page, select "view page source", (if you've never done this you can try it with any web page) copy all the HTML code and slap it into any HTML editor. Then they just edit the code to change where the information that the mark types in goes to, and upload it to their own web host.

Before, anybody asks, no I don't know how to do this because I create spoof pages to scam people out of their personal information...

When I was first teaching myself how to do basic HTML editing for my own websites, I would sometimes find a site with some functionality I wanted to include and copy that code so I could adapt it for my own site.

Then there are a couple grammaticalization errors...

And that ruled out Gob, how exactly?

Lazy users get what they deserve when they fall for this shit and don't pursue it further.

Whenever I get a hinky email like this I immediately forward it to the company's legitimate email "spoof" site, let them know I suspect -- or know absolutely -- that I'm being scammed. They usually send me an email explaining the hoax -- or if it might be a real consumer update. I always follow my gut and I haven't been wrong yet.

A minute of caution saves days of pain and confusion.