{"success":true,"data":{"id":"fake-apple-id-icloud-account-suspended-phish","label":"Fake Apple ID / iCloud account suspended phishing — impersonates Apple security notices claiming the Apple ID was locked or suspended due to unusual activity, driving to a credential-harvest page; Apple is a top-5 most impersonated brand (APWG); FBI IC3 2023: Apple impersonation scams caused $300M+ in losses","description":"Phishing emails impersonating Apple security notices to claim the victim's Apple ID has been locked, suspended, or disabled due to unusual sign-in activity — then directing to a polished credential-harvest page styled as Apple's sign-in portal. Key facts: (1) APWG 2024: Apple is consistently in the top-5 most impersonated brands globally; Apple ID phishing is categorically distinct from Apple Pay phishing (targets payment) and Apple order-confirmation phishing (targets order anxiety); this signal specifically targets account-access fear; (2) FBI IC3 2023: Apple impersonation scams (combined across Apple ID, Apple Pay, and Apple Support vectors) caused $300M+ in reported losses, with credential theft enabling downstream attacks including SIM-swapping, cryptocurrency theft, and takeover of linked financial accounts; (3) The urgency mechanism is deliberately calibrated: \"your Apple ID will be permanently disabled in 24 hours\" creates a time-pressure that bypasses rational evaluation, causing recipients to click through fear rather than curiosity — the same mechanism used in tech-support and IRS impersonation scams; (4) Apple ID credentials are high-value targets because they unlock iCloud backups (which contain messages, photos, and app data), Apple Pay, App Store purchases, and iCloud Keychain passwords — a single compromised Apple ID can expose far more than a streaming account. Legitimate Apple security emails arrive exclusively from apple.com domains, do not threaten permanent deactivation via a link, and always direct users to iforgot.apple.com for password resets. Warning signs: sender domain not apple.com or icloud.com, threat of permanent account deactivation, link to a non-Apple domain, no reference to the specific device or location of the suspicious sign-in.","tier":"danger","category":"phishing","isThin":false}}