26

I received an email with the subject "Your invoice from Apple #xxxxx". It then continues by: "[...] your payment from "Pokemon Go was accepted [...]". That line made me sceptical. I just downloaded the app recently. How could the scammer know this? Was it just a good guess?

I assume it to be scam since:

  • The sender is surpressed
  • Typos
  • No Username / data
  • Generic text
  • A suspicious little pdf
  • Not the signature / style from your friendly, expensive fruit seller tech company

Some online warning sites already caught up on it

What I could think of:

  • Another free app reports my other apps to the vendor
  • A site I often visit has cookies that I was looking up stuff from let's go pikachu
  • My account could actually be compromized and someone has access to my records
  • Many people have the app installed
    If only a fraction of the people who have the app open the attached pdf the scammer wins.

Anyway, how could this be and what counter messurements can I apply?

Peter
  • 363
  • 3
  • 7
  • "Many people have the app installed and some people that actually have it open the pdf without hestitation" what do you mean by this? Is there a .pdf attached to the email? Im quite confused where "the pdf" is coming from – Flying Thunder Mar 14 '19 at 13:55
  • Why is this obviously a scam? It's been a while since I bought something from the app store but isn't this typically what happens after a purchase? You get an email confirmation. What exactly about this makes you think it's a scam? – JimmyJames Mar 14 '19 at 14:07
  • 41
    If you have pokemon go, it catches your interest because it seems more legitimate. If you don't have that app, it catches your interested because, who just bought that on my account?! Either way they have had an effect on you. – JPhi1618 Mar 14 '19 at 14:24
  • 3
    Considering I'm getting the same emails, it's safe to say they _don't_ actually know anything. – oarfish Mar 15 '19 at 13:30
  • @FlyingThunder its a common scam email and there is always a pdf attached - it tries to get people to open it to see what they are supposed to have brought. I get them and I don't even have an iphone - its obviously a scam as apple don't attach pdfs to bills and it always claims to be about a popular app to increase the chance you might have the app installed – Matt Mar 17 '19 at 13:49

5 Answers5

78

It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device.

My guess is that the scammer does not know anything about you. The app in question is widely popular and one of the most successful apps on both iOS and Android. An attacker may just send out large amounts of mails containing such "most probable apps"/"best guesses". It would have been the same if the scammer sent an invoice for WhatsApp, which you most probably have installed on your device.

This tactic can also be observed in other recent spam waves like the notorious sextorion scam where the attacker sends a rather ominous remark about your porn preferences:

i installed a software on the adult videos (pornographic material) web-site [...] 1st part displays the video you were viewing (you’ve got a nice taste haha)

So to sum it up, this is most likely just a wild, but very probable guess, and you are not compromised. Countermeasures in this case: delete the email, go catch some Pokémon and have fun.

SeeYouInDisneyland
  • 1,428
  • 9
  • 20
  • 14
    I received that mail too, but don't have a Apple/iTunes Account/Device, nor bought something in PokemonGo (but had it installed on my Android Devices) so that mail was instantly deleted as scam for me because i don't apply to my in any way. I also received a mail in the past regarding a invoice of WhatsApp (befor it was entirely free) that a monthly subscription has been paid – Serverfrog Mar 14 '19 at 16:01
  • It's random.... I've not had that email, but several about my iTunes account being blocked (I don't have one) and too many to count about blocked bank accounts with banks I don't bank with (but surprisingly few pretending to be from the bank I _do_ bank with) – TripeHound Mar 14 '19 at 19:48
13

Pokemon Go is a very popular app. I would not be surprised if that email was being scatter-gunned to see who might panic and do what the phishing email wants. The other possibilities include:

  • Niantic (the devs of Pokemon Go) has been compromised - not very likely
  • The providers of another app on your phone have detected you use it and have sold that info onto someone else.
  • The attackers know either you have a Pokemon Go or an Apple account - not necessarily both.
  • You yourself provided that information somewhere
  • Another one of your accounts, where you have used your email address and talked about Pokemon Go on iPhone, has been compromised
520
  • 723
  • 3
  • 5
10

Former Apple Inc. employee here. I have seen some shady stuff on people's phones and what you're experiencing isn't new--I have received the same emails. That's how they phish people. They get receivers of the email to contact them, then try to dispute the charge, unknowingly giving over private information to help "resolve" the issue. If your account has been compromised, they can see your app purchases. Purchases include free downloads. Here's what I'd suggest to check:

  1. Firstly, check the email address from the email. If it's non-Apple, dismiss it.
  2. Check the devices associated with your phone. Settings>Your Name(top). There, if you scroll down, you should see a list of your Apple Devices. If you do not recognize one. You may have someone signed in to your account.
  3. Check your "Family Sharing" tab. If you are a part of a family you shouldn't be, you may be compromised. (Settings>Your Name>Family Sharing)
  4. Check to see if there is a "Profile" on your phone. This is popular with business phones to monitor employees, but some people use this maliciously. (Settings>General ... scroll and look for something that may not belong).
  5. This one is tricky, make sure when you're connected to wifi, you're on a known secure network. Users often join networks to save their data, but I personally have known people to travel with a hotspot in populated areas to get people to connect to it. From there, they can find a way to mess with your device or information. Same goes with connecting to those free chargers in public spaces, like at airports -- be very wary.

Hope this helps someone

bs.gk
  • 134
  • 4
  • 5
    Also keep in mind that email addresses are pretty easy to spoof; in doing step 1, also look at the full message source/headers in your email client and look for the `Received:` lines. If there are any of those *other than* your mail provider and apple.com, it's almost certainly a forgery. – fluffy Mar 14 '19 at 23:37
-2

Answer void in light of updated info in question.

Sounds like a valid invoice for an in-app purchase. Invoice in this case just means receipt - not that you need make additional payment action. So just Apple notifying you its processing the payment and that the source was from (within) Pokemon Go.

But info for scammers is readily available. Its all part of the marketing frenzy that has been building since the mid-1990s. Lots of websites and businesses trade marketing data to help sell products. Lots bad security on those databases or legitimate sales with too few questions asked.

Read those OS and application EULAs. Getting marketing data about your interests to vendors who might sell similar or connected products is an intrinsic part of commercial OS and apps -- and even ISO standards. Cookies are just one avenue for direct query of your phone/computer. Almost 20 years ago I was surprised as a neophyte web administrator that Microsoft websites automatically harvested the default email address of every website user. A legitimate HTTP query from server which even compliant open source software must have the ability to honor (but can default responding to be off).

To be honest, I would not be surprised if most web browers cough up matching app info to the right webserver queries. Apple/iTunes is a LOT better about privacy from vendors than Android/PlayStore but not immune I bet. iTunes itself may let registered vendors indirectly send messages to app owners based on specified criteria...for a fee. I would expect Apple policy is to review such messages first but everyone has bad or rushed days. I do not know actual details though since I am not a registered vendor.

schroeder
  • 123,438
  • 55
  • 284
  • 319
NotSoSimple
  • 1
  • 1
  • So go through all the options about privacy on your ITunes account as well as iOS and each browser and app. App notices is a new buzzword to ways vendors can intrude into privacy. – NotSoSimple Mar 14 '19 at 15:49
  • Hey, I added lines that build up to my suspicion. This is almost definitly not from apple / iTunes – Peter Mar 14 '19 at 15:52
  • 1
    Right email client can see actual header. Suppressing visible email header is not as suspicious as you might think. Some big companies do it to keep people from replying to unmonitored email address. – NotSoSimple Mar 14 '19 at 16:02
  • But Yeah big alert if more than one typo & attaching PDF without comment especially when size says it could have been inline. – NotSoSimple Mar 14 '19 at 16:05
-4

If there is no actual email header even to special email clients that can show invisible email header info...then you need to suspect that it did not arrive by email. No header is like letter without address, won't get delivered.

This can happen at the email server if server is running a bad app or otherwise got intrusion. If its Apple mail or other really big and professional provider, I would not expect this. But college email servers and other lower level or private providers might occasionally have issues.

* Its possible for another "bad" app on your phone to inject stuff into your email queue if you are not using webmail. * I would not expect this if all your apps are through Apple Store/iTunes.

But if you jail broke your iPhone to add any unapproved apps... now is the time to re-evaluate them. Even if they appear to deliver the promised functions (game?/game hack), they may also do something else as well.

NotSoSimple
  • 1
  • 1