Apple Pay Phishing Using Fake Apple Support Calls to Steal Payment Details

A phishing campaign targeting Apple Pay users is using realistic-looking emails to push victims into calling a fraudulent “Apple Support” phone number, shifting the attack from link-clicking to vishing (voice phishing). The lure commonly claims a high-value Apple Store charge was attempted or stopped, and includes plausible details (e.g., case ID, timestamp, and an “appointment” to review the activity) to create urgency and legitimacy.

Malwarebytes reported the operation’s objective is to extract login/verification codes and payment data during the phone interaction, enabling attackers to take over the victim’s Apple account and potentially access associated data and linked payment methods. Follow-on reporting highlighted the use of Apple branding and invoice-style formatting (including high-ticket purchase claims) to increase conversion, and emphasized the potential impact of account compromise beyond payment theft (e.g., access to stored personal data and connected services).