New phishing scam targets Apple and Amazon users with fake pop-up warnings
Cybersecurity firm Malwarebytes has flagged a new phishing scheme that uses fake browser pop-ups to impersonate Apple and Amazon, warning users of a $149.99 unauthorized charge and directing them to call scammers.
A new phishing scam is circulating online, using the names of two of the world's most recognizable tech companies to trick users into handing over personal information and money. The scheme, recently highlighted by cybersecurity firm Malwarebytes, combines fake browser pop-ups with cloned versions of Apple and Amazon websites to convince victims they have an unauthorized charge on their account.
The scam works by displaying a malicious pop-up that appears to be a legitimate notification from Apple or Amazon. The pop-up warns that a suspicious pre-authorized payment of $149.99 has been detected on the user's account and directs them to call a phone number if they did not authorize the charge. The number connects to scammers posing as customer service representatives, who attempt to extract login credentials, payment details, addresses, or other sensitive information.
Malwarebytes notes that the scam is delivered through compromised websites, browser redirects, or malicious ads. The pop-ups are designed to look authentic, with rounded corners and blue buttons on the Apple decoys, and they appear over what looks like the real Apple or Amazon website. In reality, the background is usually a screenshot or a cloned site designed to make the notification seem genuine.
The psychological tactics behind the scam are carefully calibrated. Most people have an Apple or Amazon account, so a notification from either company is likely to grab attention. The fake alert then creates a sense of urgency by claiming the account or payment method may be compromised and requires immediate action. The $149.99 figure is also deliberate: it is a realistic amount for a product sold on Amazon or a yearly subscription on Apple's App Store, which makes the warning feel plausible enough to lower defenses.
If a victim calls the number, the scammer may try to obtain login information, passwords, payment details, or other personal data. In some cases, the scammer may pressure the victim into making a payment with a credit card or gift card to supposedly protect their account. The pop-ups often include threatening language, warning that failure to act could leave the user financially or legally liable.
Security experts say there are clear signs that a notification is fraudulent. Apple and Amazon do not alert users about account or payment issues through browser pop-ups. They communicate through emails, in-app notifications, or activity log alerts within the account itself. The pop-ups also direct users to call a phone number, which neither company does in such alerts.
To protect against the scam, users should never click on a browser pop-up that claims to be an urgent notification about compromised account or payment details. If an unauthorized charge is actually pending, the user's bank or credit card company will also know about it. The safest approach is to close the browser, navigate directly to Apple's or Amazon's official website, and check the account activity log there. Users can also verify the phone number shown in the pop-up by searching for it online using scam-tracking tools such as Scamwise or Malwarebytes's Scam Number Check website.
