A scammer details how voice phishing groups are abusing Apple's support line to generate “account confirmation” message prompts from Apple to their customers
If you get notifications on your Apple devices about password resets and you suddenly get a call by Apple Support to ‘help you out’: hang up. — Read the full story below. It's worth checking out. [embedded post] Dale Ryder / @kryton3298 : KrebsOnSecurity recently told the saga of a cryptocurrency investor named Tony who was robbed of more than $4.7 million in an elaborate voice phishing attack. The crooks appear to have initially contacted him via Google Assistant, an AI-based service that can engage in two-way conversations. Lili Saintcrow / @lilithsaintcrow.com : “In essence, the voice phishers are using an automated Apple phone support line to send notifications from Apple and to trick people into thinking they're really talking with Apple.” Annelise / @mxannelise : More news you can use (and hopefully will never have to) about an elaborate phishing scheme involving impersonation of Google or Apple security personnel krebsonsecurity.com/2025/01/a- da... David M. Schulman / @schul.dev : i wouldn't call it extremely sophisticated, but this is an extremely well-coordinated crypto phone phishing scheme. moral of the story: if you get a call pressing you to take an action, hang up and call the company directly. even @mcuban.bsky.social fell for this — krebsonsecurity.com/2025/01/a- da...
Context & Ripple Effects
This report extends a pattern in which attackers exploit familiar Apple interfaces to make fraud look legitimate. Apple users had already reported MFA-bombing alert floods designed to wear down resistance to login or password-change requests.
The social-engineering layer is also evolving beyond generic robocalls: prior coverage documented voice-cloning impersonation scams. Here, an Apple-generated confirmation prompt can supply the institutional signal that makes a live phishing call more convincing.
First-order effects
- Apple customers receiving unexpected password-reset prompts and follow-up support calls face a more credible account-takeover lure, because the prompt originates from Apple's own support workflow.
- Voice-phishing groups gain a way to pair a trusted Apple notification with their call script, exploiting the gap between a genuine system message and an illegitimate caller.
Second-order effects
- Apple Support must contend with its automated call flows functioning as a phishing prop; customers are pushed toward independently initiated support contact rather than trusting inbound calls.
- The tactic reinforces the value of multi-step social engineering: alert fatigue from repeated authentication prompts can be combined with a human voice to convert uncertainty into approval or disclosure.
Third-order effects
- If this pattern persists, account-security design will increasingly be judged on whether legitimate recovery and verification signals can be safely distinguished from attacker-triggered ones, not merely on whether the signals are authentic.
- Voice, assistant, and support channels are becoming a shared fraud surface: automation that improves customer access can also give scammers better timing and credibility unless workflows limit attacker-triggered interactions.
The trend: This is part of the broader shift from standalone phishing messages to coordinated, multi-channel attacks that combine trusted platform signals with real-time voice manipulation.