{"id":2281,"date":"2026-03-09T15:11:29","date_gmt":"2026-03-09T15:11:29","guid":{"rendered":"https:\/\/icelandconsulateghana.com\/matt-gone-almost-phishin\/"},"modified":"2026-03-09T15:11:29","modified_gmt":"2026-03-09T15:11:29","slug":"matt-gone-almost-phishin","status":"publish","type":"post","link":"https:\/\/icelandconsulateghana.com\/is\/matt-gone-almost-phishin\/","title":{"rendered":"Matt: Gone (Almost) Phishin\u2019"},"content":{"rendered":"

This is a little embarrassing to share, but I\u2019d rather someone else be able to spot a dangerous scam before they fall for it. So, here goes.<\/p>\n

One evening last month, my Apple Watch, iPhone, and Mac all lit up with a message prompting me to reset my password.<\/em> This came out of nowhere; I hadn\u2019t done anything to elicit it. I even had Lockdown Mode<\/a> running on all my devices. It didn\u2019t matter. Someone was spamming Apple\u2019s legitimate password reset flow against my account\u2014a technique Krebs documented back in 2024<\/a>. I dismissed the prompts, but the stage was set.<\/p>\n

What made the attack impressive was the next move: The scammers actually contacted Apple Support themselves, pretending to be me, and opened a real case claiming I\u2019d lost my phone and needed to update my number. That generated a real case ID, and triggered real Apple emails to my inbox, properly signed<\/em>, from Apple\u2019s actual servers. These were legitimate; no filter on earth could have caught them.<\/p>\n

Then \u201cAlexander from Apple Support\u201d called. He was calm, knowledgeable, and careful<\/em>. His first moves were solid security advice: check your account, verify nothing\u2019s changed, consider updating your password. He was so good that I actually thanked him for being excellent at his job.<\/p>\n

That, of course, was when he moved into the next phase of the attack.<\/p>\n

He texted me a link to review and cancel the \u201cpending request.\u201d The site, audit-apple.com, was a pixel-perfect Apple replica, and displayed the exact case ID from the real emails I\u2019d just received. There was even a fake chat transcript of the scammers\u2019 actual conversation with Apple, presented back to me as evidence of the attack against my account. At the bottom of the page was a Sign in with Apple button that he told me to use.<\/p>\n

I started poking at the page and noticed I could enter any case ID and get the same result. Nothing was being validated. It was all theater.<\/p>\n

\u201cThis is really good,\u201d I told Alexander. \u201cThis is obviously phishing. So tell me about the scam.\u201d<\/p>\n

Silence. *Click*.<\/p>\n

Once I\u2019d suspected what was happening, I\u2019d started recording the call, so I was able to save a good chunk of it, which Jamie Marsland used to make a video about the encounter. You can hear for yourself exactly how convincing \u201cAlexander\u201d was.<\/p>\n

So let my almost-disaster help you avoid your own. Remember these rules.<\/p>\n