Is this email a scam? How to check before you click

Signs an email is a scam

• Urgency or a threat: your account will be closed, a fine will be added, or you have 24 hours.
• A request to sign in, confirm your details, pay a small fee or call a number, through the message itself.
• A sender name that looks right with an address that doesn't, such as a free mail address or a domain with an extra word or letter.
• A link whose real address is not the company's own site, or a QR code or attachment where a link would normally be.
• A greeting with no name, or your email address instead of your name.
• An invoice, receipt or renewal for something you didn't buy, with a phone number to “cancel”.
• A prize, a refund or money you didn't expect.

Spelling mistakes used to be the giveaway, but many scams are now well written. Judge a message by what it asks you to do, not by how it looks.

How to check a sender and links in Mail

1. The sender: in Mail, move the pointer over the sender's name, or click it, to see the full address. A message “from Apple” sent from anything other than an apple.com address isn't from Apple, though a real-looking address alone doesn't prove a message is genuine.
2. The links: rest the pointer on a link without clicking; its real address appears after a moment. Read the part just before the first single /: in apple.com.account-check.net the site is account-check.net, not Apple.
3. The headers: choose View › Message › All Headers. In Authentication-Results, spf=fail or dkim=fail for a big company's domain is a strong sign the message is forged.
4. Attachments: don't open an invoice, voicemail or document you weren't expecting, especially a .zip, .dmg, .pkg or .html file. A “PDF” that turns out to be an app is always a trap.

Scams that target Mac users

• “Your Apple Account has been locked” or “Your iCloud storage is full, your photos will be deleted”, with a link to a fake sign-in page.
• App Store or Apple Pay receipts for a purchase you didn't make, asking you to click or call to cancel.
• Renewal notices for Norton, McAfee or Geek Squad, with a phone number. Calling leads to a fake support agent who asks for remote access to your Mac.
• Delivery, toll and tax messages, often by text rather than email, asking for a small payment.
• “I hacked your camera” emails that quote an old password from a data breach and ask for Bitcoin. Nobody watched you; change that password if you still use it, and delete the email.

A pop-up in your browser that says your Mac is infected and gives a phone number is the same scam in another form; see the “Apple Security Alert” scam.

What to do if you clicked, replied or paid

• You only opened the email or the page: close it. Opening a message or a web page rarely does harm on its own on an up-to-date Mac.
• You entered a password: change it straight away on the real site, and anywhere else you use it, and turn on two-factor authentication. Check the account's recent sign-ins and forwarding rules.
• You entered card or bank details: call your bank using the number on your card, and block the card.
• You downloaded and opened a file, or gave someone remote access: disconnect from the internet and follow how to remove malware from a Mac. Change important passwords from another device.

How to report a scam email

• Scams pretending to be Apple: forward the message to reportphishing@apple.com.
• In Mail, select the message and click the Junk button, so similar messages go to the Junk folder.
• Gmail, Outlook and other webmail have a Report phishing option in the message's menu.
• If you lost money, report it to your bank and to your country's fraud reporting service.

Check a message with Tidy My Mac

• Scam Detector: paste a suspicious email, text or DM, and see how risky it looks and why, pointing to the urgency, the links and the requests in it. With Apple Intelligence it runs on your Mac and the message goes nowhere.
• Web Protection stops known phishing and scam sites loading, in every browser and app, if you do click.
• Antivirus scans attachments and downloads as they arrive.