New iTunes Store scam

onelessprob

See below email. Almost had me there for a second!

Reading this, you would think "I haven't ordered Football Manager Handheld from a Windows PC in the UK". Clicking on the "Payment Cancellation Form," which outwardly appears an apple.com url, hyperlinks to http://www.fontecal.it, a known phishing domain, where there is a form page for personal data, same layout as the iTunes account page.




From: iTunes Store [itunestore.int@apple.com]
Sent: 22 April 2014 16:56
To: ___________
Subject: Thank you for your purchase

Dear customer,

This is an automated reply, but your Apple ID was just used to download Football Manager Handheld 2014 from the App Store on a computer or device that had not previously been associated with that Apple ID.

Order Number: QAPPCCVW21HDST
Order total: 9.35 £

If you initiated this download, you can disregard this email. It was only sent to alert you in case you did not initiate the download yourself.
If you did not initiate this download, we recommend that you go to iTunes Payment Cancellation Form to change your password, then
See Apple ID: Tips for protecting the security of your account for further assistance.

How to resume Payment Cancellation Form iTunes Store downloads
http://support.apple.com/kb/QAPPCCVW21HDST/Cancel


Please do not reply to this email. Thank you for your patience.

Sincerely,

iTunes Store Customer Support
http://www.apple.com/support/itunes/

---

Apple ID : _____________
Lang_Country : en_UK
Product : iTunes Store
Support Subject : iTunes Store
Sub Issue : Connecting to iTunes Store with computer
GCRM Case ID : QAPPCCVW21HDST
See additional info below
What device did you use to connect to the store? Windows computer (PC)
Choose the iTunes Store or App Store for your country: United Kingdom

---

Dades

Deleted a few of them in the last year!

Same rule as applies in general - always check the actual reply address and to be really sure never click on anything you didn't request to be sent.

Interslice

My dad got this exact e-mail day before yesterday through his work e-mail.

Maybe targeting large institutions with john.smith@whatever.ie

https://isservices.tcd.ie/alertdetail.php?recordID=1169

Not sure what it's trying to achieve. When you put it into the browser it return page not found on the apple site.

brav

Interslice wrote: »

My dad got this exact e-mail day before yesterday through his work e-mail.

Maybe targeting large institutions with john.smith@whatever.ie

https://isservices.tcd.ie/alertdetail.php?recordID=1169

Not sure what it's trying to achieve. When you put it into the browser it return page not found on the apple site.

Thats a weird one, its asking to go a link which does not exist on apple's website, and it also asks not to reply to the email

onelessprob

In the email itself, that link to the "apple store" was a hyperlink to a different address completely, to the fishing website. If you copy and paste, it brings you to apple store, but hover you're mouse over the URL and you'll see it actually links you to http:/themarketmonk.com/cli/apptips_cancel.

Challo

This link came to my personal email on my iPhone. I actually thought my brother was using my card so I clicked on the link. Quickly realized it must have been a scam. When I clicked on the link, it brought me to a page that was not found as previous poster said. Can I just check though - did I cause any harm by clicking on the link initially?? Any advice welcome, I've got pretty limited IT knowledge, thank you in advance