Apple device users are dealing with a tricky scam called "multi-factor authentication (MFA) bombing" that's trying to steal their information.
Some Apple users have been reporting that hackers are using Apple's password reset feature to send them a lot of notifications, asking them to change their Apple ID password. If you click "Allow," the bad guys get closer to taking over your account because they can make a new password for your Apple ID. But even if you click "Don't Allow" to say no to all these messages, the problem doesn't go away.
This technique is not a new one. Google and Microsoft often experience the same form of attack, so it is critical to be fully aware of MFA prompts and not just blindly hit "yes" all the time.
For those that didn't let their passwords change, the hackers did something different with this latest attack. The victims got calls from the scammers pretending to be from Apple's support team (they even spoofed Apple's phone number!). The scammers wanted to send a password reset code to the user's phone and get them to tell them the code. With that code, the scammers could change the Apple ID password and take over the user's account. (Remember: if anyone ever calls you for any reason, be it a bank, your IT provider, or any big brand, ask them if you can call them back to continue the process. Look on the back of your bank card and use that number only to call them. And if they insist you don't call them back, hang up).
Phishing scams, where people try to trick you into giving them your private info, have been around for a long time. Lately, more scammers are using phishing, especially to get into phones, delete stuff, and take money. In 2022, there were 61% more phishing attacks on phones than the year before.
It's not clear how many Apple users have been hit by this MFA bombing scam. But the attacks have reached iPhones, Apple Watches, and Macs, showing it's a big problem with no easy fix yet.
One person said they called Apple for help, and Apple suggested making a recovery key, a special 28-character code, to change their Apple ID password. But even with this recovery key, the annoying notifications kept coming. This means there might be a big problem with Apple's password reset process that needs fixing.
For now, the best thing Apple users can do is to stay alert. If you get weird messages asking to reset your password that you didn't ask for, always press "Don't Allow." And if you get a call from someone saying they're from Apple, remember that Apple won't call you asking for information. No bank or multi-national company would ever do that. Especially if they call from 1-800-275-2273, don't talk to them or give them any info.
Just hang up.