New password reset attack targets Apple device users - what to do if it happens to you (ZD-Net)

[hlthe2b]

Please don't be a victim.... I tried to include the most important bits of the article, but best to read the full link

https://www.msn.com/en-us/money/other/new-password-reset-attack-targets-apple-device-users-what-to-do-if-it-happens-to-you/ar-BB1kE7xL?ocid=msedgdhp&pc=LSJS&cvid=7de468e2bbaf46ba95eecde51e45da20&ei=12

Apple device owners are facing a new phishing hack that uses "multi-factor authentication (MFA) bombing" to steal their data.

Several Apple users in recent days have reported a hacking attempt that appears to take advantage of Apple's password reset feature, KrebsOnSecurity reported, citing people who have been targeted. The scammers have used Apple's password reset tool to spam their targets with dozens, if not hundreds, of notifications, asking the user to reset their Apple ID password. Pressing the "Allow" option gets the scammers one step closer to resetting the user's credentials because that device could then be used to create a new Apple ID password. Unfortunately, tapping "Don't Allow" on all the notifications doesn't solve the problem.

After those targeted by the scam chose to not allow their passwords to be reset, they received phone calls from the scammers claiming they were from Apple's support team, according to the report. Their goal was to send a password reset code to the user's device and have the user tell them the code. Armed with that information, the scammers could simply reset the Apple ID password and get full access to the user's account.
--snip--

For now, if you're an Apple user, your only option is to stay in the know and remain vigilant. If you receive a slew of password reset requests that you didn't initiate, be sure to always choose the "Don't Allow" option on the notifications. Don't be tempted to choose "Allow" simply because the notifications aren't allowing you to use other apps or services on your device -- a core component in the fraudsters' plan. Even if you don't choose "Allow," be prepared for a call and be sure not to answer it.

Additionally, Apple has made it clear that the company does not call any of its users directly. So, if you receive a number from 1-800-275-2273 (Apple's actual support line that the scammers are spoofing to make their calls seem legitimate), don't pick up and definitely don't provide any information to the caller.

[Lulu KC]

1. Thank you! n/t

[Auggie]

2. Thanks

[50 Shades Of Blue]

3. Thanks for the info!

[bahboo]

4. many thanks for this...

[twodogsbarking]

5. Tom from Microsoft doesn't call any more to help us reset our computer.

I told him he should get a real job. Maybe he did.

[SunSeeker]

6. K & R

[AllaN01Bear]

7. i dont answer any number i dont know . on my land line , yes i have a land line , i have the ringers turned off

and in silent mode. on phone i am aware of many risks and am cautious of any thing i get on there .when your caller id shows your own name and phone number you know its a scam. i even got one from the catholic arch dioceses of san jauquin and it was a out of country number.

[Dem2theMax]

13. I have a landline and I do the exact same things.

I live in fire country, and a landline is essential. Cell phone service is spotty at best.

I love being able to set the landline to silent mode, ringer off. Peace at last!

[AllaN01Bear]

8. book marked .

[ToxMarz]

9. If you get dozens to hundreds of notifications and phone call..

a phone call from 'Apple' no less. Seriously, that should be a huge clue something very wrong is going on. Google, Microsoft, IBM, Apple, they don't call you. They have no interest in talking to you. And if you have an iPhone, Apple doesn't need to call you to reach you, they control the device they would be calling you on.

[StarryNite]

10. Thank you

[Tetrachloride]

11. As an aside, the phone companies can take multiple steps to alleviate the situation.

BUT THEY DON'T.

[AllaN01Bear]

15. its interisting that last summer the fcc shut down a huge illeagel call center in the us.

didnt take them long for them to come back uo. and it is also interisting that a small group of youtubers can shut them down. however , i understand that investigations take a long time .

[sarchasm]

12. Kick

[Abigail_Adams]

14. I got one a few days ago on my Mac.

It purported to be from Apple telling me my Apple ID was blocked "for security reasons." Since I was on iCloud at the time, I had my doubts. I did not click on the box to sign in. I hovered over the sender's name, and behind "Apple" was [e-mail]. "Bravo" is pretty dumb.

I found an address to send suspect emails to Apple: [e-mail]. That's what I did.

[hlthe2b]

16. I've seen at least a half dozen technical site emphasizing this as a big deal this AM, so Kicking for DUers