Fake Apple Pay Alert Pushes iPhone Users to Call

A scam web page imitates Apple Pay, Face ID, and an App Store charge to scare iPhone users into thinking a $657 payment went through. It then claims the victim’s Apple ID is locked and repeatedly tries to get them to call a fake “Apple Support” phone number, including using the phone’s own text-to-speech voice to sound more legitimate.

Key findings

• A mobile web page fakes an Apple Pay/App Store payment for $657 and displays “Face ID · verifying identity” to look like a real device authorization step.
• The page then switches to an “Apple ID locked” message and pushes the victim to call a phone number shown as “Apple Support immediately.”
• The scam uses the victim’s own device text-to-speech to read an urgent warning aloud, increasing believability.
• The receipt details are largely hardcoded (same amount, transaction ID, and authorization code for every visitor), while the date/time is generated from the victim’s device.
• The page uses aggressive navigation prompts to discourage closing the tab and to trigger a phone call via a tel: link.

Who’s being targeted

• Commonly targeted roles: All employees (mobile users), Executives, Finance and accounting, IT helpdesk / service desk (for user reporting and guidance).
• Affected industries: Consumers (iPhone users), Any organization with employees using iPhones for work.
• Attack channels: website, vishing.
• Impersonated: Apple Support.

Awareness takeaways

• Treat any urgent security pop-up that tells you to call a number on the screen as a scam, and use official support channels instead.
• Don’t interact with the page prompts (OK/Call/Verify); close the tab using the browser’s tab switcher instead of following on-screen dialogs.
• Verify charges only through trusted sources (App Store/Settings purchase history), not through a website that ‘looks like’ Apple Pay.
• If someone was convinced to call and install remote-access tools, treat it as an incident: disconnect, remove tools, reset passwords from a different device, and contact the bank.

Red flags to watch for

• A website (not the Settings/App Store) claims Apple Pay/Face ID is verifying a payment
• Urgent instruction to call a phone number shown on a pop-up/page
• High-pressure prompts that make leaving the page difficult