Last week, news of an iPhone scam spread on X as several users reported receiving numerous notifications prompting them to reset their Apple IDs. According to Krebs, a cybersecurity news and research website, this scam is known as MFA bombing. The surprising bit about this scam is that the notifications appear to be coming from Apple, making them seem authentic, and some unsuspecting users could become victims.
Parth Patel, one of the users affected by this scam, shared his experience on X. He stated that attackers utilized OSINT (Open-Source Intelligence) data from People Data Labs and caller ID spoofing. They sent multiple notifications to his iPhone around 6:30 p.m., prompting him to reset his Apple ID. Later, they called him using a number that appeared to be from Apple support.
During the call, Patel asked the attackers to provide some information about him to verify the legitimacy of the call. To his surprise, they had most of his information correct, including his email, date of birth, phone number, and current and previous addresses. Only his name was incorrect, which made him realize they were scammers.
Patel may have survived this attack because he knows how such attacks are carried out. However, many people are not as well-informed or tech-savvy as Patel.
The good news is that Apple is aware of this scam and has advised users to be wary of such notifications. They advised users to verify any claims made by scammers by calling official Apple Support numbers and reporting it to http://reportfraud.ftc.gov/ for those in the US.
Apple will also likely roll out an update soon to make such attacks harder to execute.
