FaceTime Spoof Calls Steal Codes and Money

How the Attack Worked

Scammers place FaceTime calls with spoofed caller ID so the call appears to come from Apple or a bank. The pretext usually involves a claimed iPhone or iCloud compromise or unauthorized Apple Pay charges, with the caller offering to "help" stop the attacker or reverse the charges. To sound legitimate, the caller brings up personal information early, such as a home address, employer, or Social Security number, which helps establish trust before the ask begins.

Why It Succeeded

Once trust is built, the caller shifts to urgency. Victims are told that hanging up and calling the company back will not help because the fraud will supposedly continue in the meantime, a claim that is false but effective at keeping people on the line rather than verifying independently. This pressure is used to extract credentials, security codes, or financial details, and in some cases to convince victims to disable protections like two-factor authentication (2FA) or Stolen Device Protection, framed as necessary to stop an "ongoing attack." In reality, disabling those features removes the very safeguards that prevent account takeover.

What to Watch For

• An unexpected FaceTime or phone call claiming urgent account compromise
• A caller who introduces personal details (address, employer, SSN) early to sound credible
• Pressure to stay on the line or warnings that hanging up will make things worse
• Any request to share a password, device passcode, or two-factor authentication code
• A request to tap "Accept" on a 2FA prompt during the call
• Instructions to disable 2FA or Stolen Device Protection

How to Build Resistance

Treat unexpected calls claiming to be Apple or a bank as untrusted by default, even if the caller ID looks legitimate. If a call raises suspicion, the safer approach is to assume it is a scam and contact the company directly using a number found independently, not one provided by the caller. Employees, especially those handling finance or payments, should be reminded that legitimate support teams will never ask for passwords, passcodes, or 2FA codes, and will never ask someone to approve a 2FA prompt over the phone. Reinforcing that security features like 2FA and Stolen Device Protection should never be disabled at another person's request, particularly during an unplanned call, closes off the final step scammers rely on to complete account takeover.

How do scammers use FaceTime to steal information?

They spoof caller ID to appear as Apple or a bank, then use personal details like an address or employer to build credibility before pressuring victims for credentials, security codes, or financial information.

Why do scammers tell victims not to hang up?

Callers falsely claim that hanging up and calling back will let the fraud continue, which is designed to keep victims on the line instead of independently verifying the request.

Would Apple ever ask for a password or 2FA code over the phone?

No. Apple has stated it will never ask users to log in to a website, approve a two-factor authentication prompt, or provide a password, passcode, or 2FA code.

Why do scammers ask victims to disable 2FA or Stolen Device Protection?

They frame it as necessary to stop an ongoing attack, but disabling these protections actually removes the safeguards that would prevent account takeover.