Warning: 'Your Apple ID is due to expire today' is a phishing scam

Got a text suggesting 'Your Apple ID is due to expire' or 'Your iPhone ID is due to expire'? It's rubbish. Here's how to deal with the scam message.

There are many ways you might lose your data, be it from hackers to using your iOS device on a non-secure Wi-Fi network. However, there are easier ways for those wanting to steal your personal data, from installing malicious software to falling for phishing scams. 

Back in April 2016 there were reports of people receiving texts from 'AppleInc' asking them to confirm their Apple ID as it's about to expire, and that message appears to be doing the rounds yet again in October 2017. If you've got the text, don't worry - here's our guide on staying safe.

'Your iPhone ID is due to expire today'

A slight variant on this has been observed with the words "Apple ID" replaced by "iPhone ID". This is a scam too, and should be treated with the same suspicion and self-protective behaviour described below.

Should I click the link in the text?

There are various texts that are being sent to people, such as the one pictured below, courtesy of Dave Vitty on Twitter, who has been receiving texts to change his Apple ID.

As you'll be able to see from the screenshot above a text was sent by 'AppleInc' with a website  URL to fill-in your details. These links come in different forms, so far we've seen: 'appleexpired.co.uk' / 'appleidlogin.co.uk' / 'icloudmobile.co.uk', but there might be more websites out there used for phishing purposes.

As a general rule, don't click on any of these links as it's very rare for Apple to contact you via text  message, let alone about an expiring Apple ID. While that might be obvious to some, others believe that the websites sound like those that Apple own. 

How do I know if it's an official website?

For clarification, the actual URL that is used to manage your Apple account is: https://appleid.apple.com/. This is the only place you should go to change your Apple ID information. But how can you be sure that it's not a high-end phishing attempt?

In order for you to know it's the official website, look for the Apple signed SSL certificate by the address bar. There are various browsers available, from Google Chrome (pictured below) to Safari and Firefox, which will provide you with information about the secured connection to the site you're visiting. 

You'll find that most of Apple's website and all of the parts that require you to sign-in are secured by a HTTPS, secured connection . In simple English, the websites are official, licensed websites that are owned by Apple, not a fake phishing site.

Am I in danger if I've already clicked on the link?

Often clicking a link doesn't result in an automatic virus or stolen details, although that's not to say there aren't shady websites full of tracking cookies and malicious codes that might compromise your security .

However, most phishing sites will require you to enter your details so that the hackers can have easy access to your personal details. In either scenario our advice will remain the same: Do not click on links of which you're unsure about, even if they come from your friends and family!

You may find that a phishing scam has been sent to you by a friend or family member - this is usually the case when they have accessed the site and then automatically shared the scam through their contact list.

If you ever receive a dubious text message from a contact, always question them about the link - you might even help them uncover that they've been caught by a hoax! Yes, you'll look like an honourable white knight.

Thankfully, there are measures internet  browsers take and even search engines, such as Google to take down such links.

In our example stated above for: 'appleexpired.co.uk' / 'appleidlogin.co.uk' / 'icloudmobile.co.uk', we found them to be either completely shut-down or blocked by our browser (we used Firefox for our tests).

If for any reason there are links that re-appear in the future, do not click on them. Always consult the source it has come from or dig deeper and ask your friends and family  for advice, better still ask us at Macworld.

If you've clicked on the link and submitted your details, we suggest you immediately change your Apple ID details as a minimum, along with any other site that shares  the same login.

User poll

With the above steps you should feel more secure, let us know in the poll below if you've been a victim or been a stallion and stayed away from those pesky fishers and their baits - we'll see ourselves out for that joke.