Is this email a scam?

spam

Criminals are getting very good at imitating Apple messages and sometimes the only indication in an email is very subtle. Have a look at this thread. Someone registered an Apple ID with my em… - Apple Community It can be very hard to tell from an email alone if it is authentic. The best way to check is to use an independent way through Apple's own resources to confirm what the communication claims. Scams (e-mail, text messages, and phone calls) are getting very good at closely imitating true Apple communications. Always be cautious. These support articles have some guidelines:

About identifying legitimate emails from the App Store and iTunes Store --> Identify legitimate emails from the App Store or iTunes Store - Apple Support

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Avoid scams when you use Apple Cash --> Avoid scams when you use Apple Cash - Apple Support

About Gift Card Scams --> About Gift Card Scams - Official Apple Support

If you are uncertain about a message and a resource provided in that message, do not click on any links in the message. Try to use an Apple resource you know is valid to independently verify what the message is claiming. Go to a support article page on apple.com and use the instructions in the article to verify though Apple itself, or use an Apple device feature such as Settings or an Apple app. To ask Apple start at this web page: Official Apple Support If you wish to investigate links, this post by contributor MrHoffman describes how you can do that —> "Keep your Apple Account safe and secure"… - Apple Community (the link takes you to the end of the post so scroll up a bit).

- Apple won’t warn you about disabling an account. You will find out when you try to sign in.

- Phishing emails may include account suspension or similar threats in order to panic you into clicking on a link without thinking. They may report a fake purchase in order to infuriate you into rashly clicking on a false link to report a problem.

- Apple e-mails address you by your real name, not something like "Dear Customer", "Dear Client", or an e-mail address* However, having your actual name is not proof this isn’t phishing. Compromised databases may have your name and address in them.

- Apple e-mails originate from @apple.com or @itunes.com but it is possible to spoof a sender address. "Apple email related to your Apple ID account always comes from appleid@id.apple.com." - About your Apple Account email addresses - Apple Support

- Set your email to display Show Headers or Show Original to view Received From. Apple emails originate from IP addresses starting with "17.".

- Mouse-over links to see if they direct to real Apple web sites. Do not click on them as this just tells the spammer they have a working e-mail address in their database. If you are unsure, contact Apple using a link from the Apple.com web site, not one in an email.

- Apple will not ask for personal information in an e-mail and never for a social security number.

- Scams may have bad grammar or spelling mistakes.

- Apple will not phone you unless it is in response to a request from you to have them call you.

* Exception: I got email saying my ID is expired! Does… - Apple Community

“If you receive a suspicious link to a FaceTime call in Messages or Mail, email a screenshot of the link to reportfacetimefraud@apple.com. The screenshot should include the phone number or email address that sent the link.”

Forward email attempts as an attachment (in MacOS Mail use the paperclip icon) to: reportphishing@apple.com then delete it.

If this is with regard to a supposed purchase, this Apple article --> If you see 'apple.com/bill' on your billing statement - Apple Support has relevant information and web links for checking if you really have made a purchase or paid for a subscription. Purchases made under Family Sharing might be charged to the organizer's card but will not appear under the organizer's purchase history or subscriptions. Ask family members about those or check your receipts. Apple will email a receipt to the Family Organizer if a purchase is made on a card held by the Family Organizer. This will have the Apple ID of the purchaser, which you should recognize, but won't have specific about what was purchased.

Read this link "If you think your Apple ID has been compromised" --> https://support.apple.com/HT204145

Also make sure you are using "Two-factor authentication for Apple ID" --> https://support.apple.com/HT204915

Definitely seems like a scam. There’s no way for a card issuer, even American Express, to have access to your Apple Account or its purchases, nor is there any way to request such access to my knowledge.

Does the email have a number it would like you to call for American Express?

Also, Apple would usually address you by the name they have on file for you.

Ohhhh it's Credit Karma. I opened a new card w/ Amex and looked at my transaction details on the Amex app once. Ever since then I've been getting this email every time I go to CK. I've been waiting for a paid off loan to drop off, so I've been checking CK nearly every morning. Like clockwork, pretty soon after I look at my CK account, the email pops up. Thank you this was driving me crazy. Now to figure out how to shut it off.....

The emails are real... and annoying. I'm getting them at least every few days lately. If you log in to American Express and go to your transactions and find your monthly iCloud transaction, there's a button to view details, and it opens an Apple-generated receipt. So I think Apple is sending these emails to warn people, "Hey, someone viewed that receipt, if it wasn't you, then someone might have your amex credentials." But in reality, I think this is getting triggered by various integrations/API invocations. Some people in this thread have mentioned QuickBooks, for me I think it might be CreditKarma. Something is probably regularly pulling transaction details and tripping this email.

I have received four of these so far and have been ignoring them, mainly because they don't address me by name.

What intrigues me is that unlike spam or phishing attacks, there is no direct call to action other than to contact American Express. No link, no phone number, no attachment, not even a request to reply. The worst thing it could do is cause a flood of calls to AmEx's call center; a denial of service type attack. Maybe that's their goal.

As for authenticity, all the links in the footer link to apple.com--the standard links you would find in an Apple email. Looking at the email headers, the From and Reply-Path addresses are email.apple.com. The sender IP address, 17.23.6.66, appears to be owned by Apple. If this is a fake, it is a very good one. I'm almost wondering if an account at Apple was compromised. But a hacker capable of that would have had a better end goal.

Unless I've missed something, all I can think of is the spammer/hacker forgot to include a link or phone number. But this email is otherwise done too well to miss something as important as that.

Hmmm...

Same here, and the same puzzlement. It's a legit Apple email, but the call to action (contact Amex with no actual context) doesn't make sense. I've checked my Apple account and Amex accounts, and there's been no surprise activity. I think its getting triggered by automatic software access (Quicken in my case) or some sort of Points calculator on the Amex side.

So weird, annoying, but harmless.

I’m downloading AMEX data daily with Quicken. This happens every time there is an Apple Pay transaction in my AMEX data.

So it is definitely NOT a scam.

But, why did this suddenly start happening?

I don’t think we’ll get an answer from either Apple or AMEX, just mutual finger pointing.

If anyone has an idea how to track this down, please share with the community :-)

I just received this and found this thread. I did had to reconnect my AMEX on my Quickbooks for my business. Guessing if it is not spam that was my trigger.

I'm guessing this is an Apple glitch.

The email it comes from is verified by Google.

The account email it references is mine and associated with my Apple Store account(that's easy to fake).

All the links are legitimate links.

And I get these emails every time now that I use Apple Pay.

Amex has no clue, of course and blame it on Apple. (I'm sure Apple will blame it on AMEX if I actually managed to talk to someone there :-)

Same here. I also have Amex account as billing account for my Apple account, and I use Quicken. I've concluded that the messages are legit though annoying.

Without any call to action, seems like a poor scam attempt.

I found some similar posts on Reddit, but none identify a cause.

A couple mention it could just be a glitch in Amex's system or something else.

Without any link to click or number to call, there is no further scam, which would make a email pointless.

I think it's being triggered by Quicken as well.

The emails seem to come soon after I've downloaded financial info into Quicken.

I’ve received several of these as well. I cannot figure out why. I use an online budgeting software that connects to my credit card account and downloads transaction data. I’m wondering if that is the source?

I’ve received several of these as well. I cannot figure out why. I use an online budgeting software that connects to my credit card account and downloads transaction data. I’m wondering if that is the source