Fake “Apple Support” FaceTime Calls Drain Accounts

How the attack worked

This attack relies on unsolicited FaceTime calls that appear to come from “Apple Support” or a bank. The caller claims there is fraudulent activity or a technical problem on the victim's account, creating a sense of urgency. Once the victim is engaged, the caller pressures them to “verify” card details, online banking credentials, or Apple ID information. In some cases, the attacker also asks the victim to share a one-time passcode or to install remote-access software so the caller can supposedly fix the problem.

Why it succeeded

Nothing in this process requires malware on the device. The exploit is human trust, reinforced by familiar branding, logos, and the immediacy of a real-time call, which tends to feel more legitimate than a text message or email. A live voice call also gives the attacker room to adapt in real time, respond to hesitation, and keep pressure on the target until they comply. Because the pretext touches on money, security, or account access, it taps directly into fear of loss, which tends to override normal skepticism.

What to watch for

• An unsolicited FaceTime call claiming to be from Apple or a bank
• Urgent language about fraud, refunds, or account problems that demands immediate action
• Any request to “verify” a password, card number, banking credential, or Apple ID detail over the call
• A request to read out or share a one-time passcode
• A request to install remote-access software from someone who called unprompted

These red flags apply whether the contact starts as a FaceTime call or as a text message that leads into one.

How to build resistance

• Treat any unexpected FaceTime call or message about payments, refunds, password resets, or personal information as untrusted, even if the caller ID looks legitimate
• Never share passwords, banking credentials, card numbers, or one-time passcodes during an unsolicited call or text
• Verify the request by contacting the organization directly through a known, trusted channel, not a number or link supplied by the caller
• Report suspicious FaceTime calls by emailing a screenshot of the call information to reportfacetimefraud[@]apple.com
• Encourage employees, especially in finance and executive roles, to report suspicious calls quickly so others can be warned before they are targeted

Because this technique targets judgment rather than technical defenses, awareness and a habit of independently verifying unexpected requests are the most effective safeguards.

How do scammers use FaceTime to steal money?

Attackers place unsolicited FaceTime calls that appear to come from Apple Support or a bank, then use claims of fraud or account problems to pressure victims into sharing card details, banking credentials, Apple ID information, or one-time passcodes.

Do these scams require malware?

No. The attack relies on human trust rather than malicious software, though some victims are persuaded to install remote-access software or hand over one-time passcodes.

How can I verify if a FaceTime call from Apple Support is real?

Apple advises treating unexpected FaceTime calls or messages about payments, refunds, or personal information as untrusted and contacting companies directly through trusted channels rather than numbers or links provided by the caller.

What should I do if I receive a suspicious FaceTime call?

Apple recommends emailing a screenshot of the call information to `reportfacetimefraud[@]apple.com` so the report can be reviewed.