Does Apple ever ask for my password in an email?

Never. Apple will never ask you to provide your Apple ID password, 2FA code, or device passcode via email or a link sent in an email.

How can I safely check my Apple ID alerts?

Don't click any links. Instead, on your iPhone or Mac, go to Settings -> [Your Name] -> Password & Security. On the web, go directly to 'appleid.apple.com'.

I entered my Apple ID on a fake site. What now?

Immediately sign in to the REAL Apple ID site and change your password. Check your 'Trusted Devices' and remove any you don't recognize. Check for any unauthorized 'Find My' changes.

iCloud Security

Verify iCloud alerts before you sign in.

iCloud and Apple ID credentials are highly valuable to scammers because they grant access to photos, backups, and the ability to lock or unlock devices. Scammers impersonate Apple Support to send fake 'Storage Full' or 'Unauthorised Sign-in' alerts to steal your credentials.

Security Insight

iCloud scams often use 'Find My Device' lures, claiming your lost iPhone or Mac has been found to trick you into entering your Apple ID on a fraudulent tracking page.

Identifies fake 'Apple Support' domains

Spots 'Device Found' phishing lures

Protects your Apple ID & Backups

Analyze an iCloud Message Apple Safety Guide

How to spot an iCloud Phishing Scam

Legitimate Apple communications follow very specific design and sender standards. Watch out for these specific red flags in any message claiming to be from Apple.

The 'Account Locked' threat

A message claiming your Apple ID has been locked for 'security reasons' and you must click a link to 'verify your identity' or your data will be deleted.

Fake 'Find My' notifications

An email stating your lost device has been located. It provides a link to a fake iCloud map where you are prompted to sign in to 'see the location'.

Non-Apple Sender Domains

Official Apple alerts come from @apple.com, @icloud.com, or @email.apple.com. Scammers use domains like 'icloud-security-check.com' or 'apple-id-verify.me'.

Request for 'Two-Factor' codes

Any email that asks you to provide your 2FA code or your device passcode via a web form is a high-risk phishing attempt.

What IsThisSpam checks before you trust a sender

Quick verdicts are useful, but the real value is understanding why something looks safe, uncertain, or risky.

Inconsistent Branding

Look for low-resolution Apple logos, weird fonts, or layouts that don't match the clean, minimalist aesthetic of official Apple emails.

Generic greetings

Apple usually knows your real name. If the email starts with 'Dear Customer' or 'Dear Apple User,' it is a generic phishing blast.

Deceptive Link Destinations

Hover over any button. If the URL doesn't end in '.apple.com' or '.icloud.com' (e.g., 'icloud-find-my-iphone.top'), it's a phishing portal.

High-Pressure urgency

Messages like 'You have 30 minutes to verify' or 'Your photos are about to be deleted' are used to panic you into acting before checking.

Related guides

Use the checker for the fast answer, then read the deeper guidance for recurring scam patterns.

Gmail Scam Checker

Learn how to spot similar phishing patterns targeting Google users.

Read the guide

Spoofed Email Checker

Verify if an email sender is forged or legitimate.

Read the guide

FAQ

These are the questions people usually ask right before they click, reply, or pay.

Got a screenshot or attachment? Our AI can analyse it.

Free scan first, deeper analysis when you need it

Check the sender before you trust the message.

Start with a fast scan, then move to SuperScan when the message involves money, account access, or sensitive documents.

Analyze an iCloud Message Apple Safety Guide