It seems like hardly a month goes by without some new or increasingly frequent online scam trying to separate us from our money or data. In June, it was the so-called Apple High Alert scam. Now it’s a swindle using both Apple and Amazon as its facade. Here’s what you need to know about the Apple and Amazon “unauthorized charge” scam—and how to protect yourself.
What is the Apple and Amazon “unauthorized charge” scam?
The scam is a phishing scheme designed to get unsuspecting targets to hand over their personal details and/or money. Phishing is the practice scammers use to impersonate legitimate organizations in hopes of extracting sensitive information or payment details from you.
The scam involves displaying a malicious pop-up in your browser that purports to be a notification from Apple or Amazon. The scam was recently highlighted by the cybersecurity firm Malwarebytes, which says the scam is delivered by compromised websites, browser redirects, or malicious ads that take a user to a website that looks like Apple’s or Amazon’s in the background. In the foreground, a pop-up will appear that matches the design language of Apple or Amazon.
The pop-up warns that a suspicious pre-authorized payment of $149.99 has been detected on your Apple or Amazon account. It then directs you to call the phone number shown in the pop-up if you did not authorize the charge, to speak with an Apple or Amazon representative, ostensibly to protect your account.
How does the scam work?
The scam works by following certain design and psychological principles.
On the design side, the pop-ups are meant to look like legitimate ones you would see from Apple or Amazon (with rounded corners and blue buttons on the Apple decoys, for example). These pop-ups also have a transparent background that shows what is apparently Apple’s or Amazon’s real website behind them, though this is usually just a screenshot or a cloned site. The point is, the pop-ups are designed to make things look as genuine as possible.
Then come the psychological tricks. The scammers know that most people have an Apple or Amazon account, which means if you see a notification from either company, you are likely to pay it at least some attention. Once the fake notification has your attention, it uses the usual phishing tricks: creating a sense of urgency by claiming that your account or payment method may be compromised and that you need to act immediately, often by calling a phone number, to protect it.
Of course, if you call the phone number, you’ll actually be talking to a scammer who will try to extract personal details from you, like your login, password, payment details, name, address, or more. Alternatively, the scammer may try to get you to make a payment with a credit card or gift card to “protect your account.”
As Malwarebytes notes, the suspicious $149.99 charge that the notification warns about also holds psychological sway. It’s a realistic amount for a product sold on Amazon or a yearly subscription sold on Apple’s App Store. The plausible amount gets you to lower your defenses, making you think, What if this is legit?
How do I know if I am the target of the “unauthorized charge” scam?
The best way to know if you are being targeted by the scam is to pay attention to where the supposed notification appears.
You should be suspicious of any notification that suddenly appears in your web browser, regardless of whether it’s on mobile or desktop. As noted by Malwarebytes, Apple and Amazon don’t alert you about account or payment issues via browser pop-ups. They’ll send you emails, in-app notifications, or activity log alerts in your account instead.
Another big tell is that the pop-up notifications often direct you to call a phone number, which Amazon and Apple won’t do. You should also be on the lookout for any doom-mongering messaging in the alert, such as threats that failure to act can leave you financially or legally liable. These are frequent tells that the notification isn’t genuine, no matter how authentic it looks.
How can I protect myself against the scam?
Never click on a web-browser pop-up that alleges to be an urgent notification telling you that your account or payment details were compromised.
If there is actually an unauthorized pending charge on your Amazon or Apple account, those companies likely won’t be the only ones who know about it—your bank or credit card company will, too. So if you see a notification that says someone is trying to make, or has made, a payment you didn’t authorize, you can simply check with your bank or credit card company to see if any charges are pending. You can also close your browser, navigate to Apple or Amazon’s real website, log in to your account, and see any pending charges there.
Finally, often you can easily identify that a notification is a scam by noting the phone number it tells you to call, then simply Googling that number or entering it into one of the many online tools that track scam numbers, like Scamwise or Malwarebytes’s Scam Number Check website.