Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Apple iTunes App Store Invoice Scam Emails
Apple iTunes App Store Invoice Scam Emails

Apple customers are asked to be aware of fake email invoices (see below) claiming that they have purchased products from Apple's App or iTunes store. The fake email invoices were sent by scammers to frighten and trick the recipients into clicking on the links within them by claiming they need to do so in order to cancel the purchases and get a refund. But, once the recipients click on the link in the fake email invoices, they will be taken to a phishing website that steals personal, financial, and Apple credentials (usernames and passwords).

Therefore, Apple customers who have received email invoices appearing as if they were sent from Apple, should avoid clicking on the links in them. They should instead, sign directly into the iTunes Store on their iPhone, iPad, iPod touch, Mac, PC, or Apple TV and check their accounts.

Sample of a Fake Apple Invoice Email Invoice

From: Apple info@appstoreonline.co.uk
Date: 17 August 2016 at 16:20:19 BST
Subject: Your Invoice No.18479101

Dear Customer,

Thank you for buying the following product on 17/08/2016 13:30:23 PM.

Product Name : Minecraft Pocket Edition
Order Number: 18479101
Receipt Date: 17/08/2016 13:30:23 PM
Order Total: 1.17 GBP

If you did not authorize this purchase, please click here for refund.

Recipients of the email voices claiming that they have ordered a product they did not, and who have clicked on the link in them, should change their Apple password and contact Apple Support for help.

Apple users, the best protection against phishing scams is to avoid clicking on links in email messages, social media messages, and text messages to sign into their online accounts.

111

Comment sectionComments / Answers (111)

Remove sensitive information from your post. Your IP address will be used to display your estimated location.

Comment count 111

by info

"From: "AppIe Store"
Subject: Re [ Payment Complete ] Thank you for purchasing the product in the App Store, at December, 31 2020 PST. Order : 28985435 [FWD]
Date: 31 December 2020 9:49:34 pm NZDT
To: no-reply.32746095-web.appsupport.world

Thank you for your purchased,

Date and time : December, 31 2020 PST

Item : Ragnarok M Eternal Love ( BIG CAT COIN )

Price : $23.99

See receipt details on file attached

Best Regard

App Store"

Here is another scam.

Delete


by an anonymous user from: Sydney, New South Wales, Australia

Another version:

From: Aῤple Store Game Receipt
Sent: Tuesday, 31 December 2019 5:15 PM
To:-bigpond.com
Subject: Confirmation Games Payment of "Head Ball 2" has been confirmed ! 20488199172


Hello ***-bigpond.com,
Thank You ! Your Payment order of "Head Ball 2" has been confirmed on Tuesday, December 31, 2019 !
Below is your invoice orders,for manage, view or cancel your order, just Download and open the attached invoice.
Thank you again for shopping with us...

Delete


by info

"I have received 3 emails now.

I have not made this order.

Regards


From: Aῤῤle Store Payment
Sent: Sunday, 29 December 2019 4:54 PM
Subject: Thank! Order Your Receipts has been sent on email. ORDERID (#119-03465281429)

Dear,

Thank for your Purchase ! Your Order of "Art of Conquest" has been completed on December 29, 2019.
Below is your invoice orders,for manage, view or cancel your order, just Download and open the attached invoice.
Thank you again for shopping with us...
Apple Store"

Received via email.

Delete


by an anonymous user from: Washington, District of Columbia, United States

I received this email and I clicked on the cancel link which directed me to a web page that looked suspicious and started auto-populating cells, so I shut it down and ran my antI virus software which later said my computer was all clear

Do you think I am in the clear?

mk

Delete


by info

You should be clear because the page is a phishing scam that steals information, it does not infect your computer or device with malware.

Delete



by info

This forwarded email was received today. We did not order 600 diamonds for $9.99.
Thanks for having an email link so that we can report this.
Mike Freschi


-------- Forwarded Message --------
Subject: #New Statement [Order Invoice] : We're processing your order W805502318. Sunday, November 24, 2019 (GMT 7)
Date: Mon, 25 Nov 2019 03:39:38 0700
From: Ap‌pl‌e‌‌‌‌‌‌‌‌ I‌D‌‌

Thank you.

You've made a purchase from Montoon on App Store.

Order Number : W805502318
Ordered on : Nov 24, 2019

You can see invoice and cancel this order on attachment. Thankyou

Delete


by an anonymous user from: Lexington, Kentucky, United States

What danger am I in for clicking on the phony invoice to cancel and then being led to an "Apple looking Site to sign in to my Apple account?

Delete


by info

Change your password before your account is hijacked and used fraudulently.

Delete


by an anonymous user from: Los Gatos, California, United States

Below is what the scammer sent me. I DID NOT click the link.

"MOBILE LEGENDS BANG BANG. *600 DIAMONDS*

Dear customers,

This is a notification you recently purchasing on an Apple ID
You have made the following purchase with details : *600 Diamonds*

App: Mobile Legends Bang Bang. Invoice Number: 3505915028
Content provider: Montoon. Total in USD: $9.99
Purchase date: August 03, 2019. Items: 600 Diamonds
Sub total: $9.99. Price. $9.99
Tax (0%): $0. Payment Method: Credit Card Linked
Total in USD: $9.99

If you do not make a purchase or you believe an unauthorized person has accessed your account, You must cancel the purchase as soon as possible ,To cancel your purchase within 48 hours, after receiving this invoice, go to CANCEL and MANAGE PURCHASE>

Sincerely,

App Store

Copyright © 2019 .AppIe Inc.
All rights reserved."

Delete


by info

Here is another scam:

-- -- -- -- --
From: App Payment
Sent: Monday, April 1, 2019 6:20:55 PM
To: secured.billing-apple.com; invoice.payment-apple.com
Subject: RE: [ Renewal Statement ] We've shipped your order "Marvel" made on ..." DOCX " 01 April 2019. [ FWD ] / RE: [Déclaration de renouvellement] Nous avons expédié votre commande "Marvel" faite le ... "DOCX" du 01 avril 2019. [FWD]

Thank you,

Here's your receipt for "Marvel Future Fight"

-Date: Monday, April 01, 2019
-Order ID: 23823729080
-Document No: MFF23823729080
-Paid Order : $29.99

What to do next:

1. Download and review receipt we attach (DOC)
2. Open and read the receipt
3. If you make this purchase, you can ignore this E-mail or cancel this order if you do not make this purchase

Thanksyou, regards
Apple Team

Delete


by info

Here is another scam:

"RE: [ Proof Of Payment! ] Thank-s you for your order 'MARVEL Future Fight' receipt invoice is delivered to ' WORD ' / Notificación de la orden! Gracias por su pedido. La factura del recibo de ''MARVEL Future Fight' se entrega ...Monday, February 4, 201...

App Store
Mon 2/4/2019 8:48 PM
apps-payment.com; please-openword.net

INVOICE-PAYMENT..docx (155 KB)

Thank you
Order Detail.

Item : MARVEL Future Fight
Date and time : Monday, February 4th, 2019
Total Paid : $29.99
Type Of Payment : Credit Card Linked

Ignore this message if you are make this order or
Open "INVOICE-PAYMENT " to cancel payment

Regards

App Store Team."

Delete


by an anonymous user from: North Bay, Ontario, Canada

I Just received the exact email less than five minutes ago, I knew something was not right because I have never used the app "marvel future fight".

Delete


by an anonymous user from: Brisbane, Queensland, Australia

I received an email from "Payment Appleid " with a PDF invoice attached and the message:

"Your apple id has been used to make illegal purchases (fraud).

Re-register your account data for security.

If the information above seems familiar, you can ignore this message."

I am satisfied that it is from a thieving mongrel, and thank you for your advice to someone else on this site, saying that invoices wouldn't be sent as PDF.

Delete


by an anonymous user from: San Antonio, Texas, United States

I have been scamemd; did not order Starlight member $15.99 per month.
I do not want to ay to have you get rid of the scam

Delete


by info

Here is another scam:

"[Receipt Transaction] Mobile Legends : 5000 Diamonds Recharge Subscription Renewal , Confirmacion del pedido Ireki eranskina (PDF) xehetasunetarako !

Dear Customer,

Thanks, your order has been Success

Name of Subcription: Mobile Legends (5000 Diamonds)

Content Provider: Apple Store Game Content.

Date of purchase: 11 - September - 2018

Subscription Period: 1 month
Price: $120.40

You can Cancel this subscription.

By clicking the link below:

My Subscriptions
Regards,
Apple Store Department"

Delete


by an anonymous user from: Oakland, New Jersey, United States

I, too, received notice that I subscribed to Mobile Legends (5000 Diamonds). I did click on "My Subscriptions" to cancel it as specified.

Am I still held or charged for this?
Diana.

Delete


by an anonymous user from: Walla Walla, Washington, United States

Received an invoice confirmation today for over $500. Do not subscribe to Itunes or any other similar gaming apps. Did not access and will delete the email.

"Mobile Legends: Bang Bang, 5000 Diamonds
Moonton
In-App Purchase
iPhone 8
Write a Review Report a Problem"

Delete


by an anonymous user from: Adelaide, South Australia, Australia

I was sent a similar email, I thought one of the kids may have downloaded it. When I opened the confirmation I saw they were asking for personal information and bank details. So I deleted the email. But I’m not sure if they can get any info to hack me.
Still worried.

Delete


by info

It is a phishing email that tries to steal your information, not to hack your device.

Delete


by an anonymous user from: Dade City, Florida, United States

Received this:

"Dеаr Customer

Wе nоtіfу уоu оf уоur сurrеnt Τrаnѕасtіоn ( ID : KKEF-21457848 ),
thаt ѕоmеоnе hаѕ uѕеd уоur іСlоud ассоunt fоr ѕuѕрісіоuѕ Τrаnѕасtіоnѕ,

Τrаnѕасtіоnѕ dеtаіlѕ :
Dаtе аnd Τіmе : Tuesday, May 22, 2018

Subscription : Starlight Member
Duration : 1 month (Auto Renewal)
Itеmѕ : Starlight Member
Οrdеr numbеr : KKEF21457848
Ρауmеnt : СrеdіtСаrd
Οrdег Τоtаl : $55.00

whаt tо dо nеxt ? The summary is attached in PDF format in this email.

Τhаnks
©Apple Team


Open Attachment: OrderID-KKEF-214578489.pdf"

Delete


by an anonymous user from: Fort Collins, Colorado, United States

Any legitimate invoice would not be attached to as a pdf.

Delete


by an anonymous user from: Brisbane, Queensland, Australia

Exactly the confirmation I have been looking for. Thank you.

Delete


by info

Here is another scam:

-------- Original message --------
From: Apple Support
Date: 4/29/18 3:39 PM (GMT-05:00)
Subject: Re : Your receipt from Apple. - Sunday April 29 2018 - Dx.-NK8N45B56E


Dear..

You have made a purchase for DC Legends: Battle for Justice

Delete


by an anonymous user from: Des Moines, Iowa, United States

Received this:

"Dear -hotmail.com
Thanks for purchasing at app store
Check your PDF Invoice
Your ID invoice is 51055602850430246737

SHIPPING TO
Ronald M Gilliland
4974 Ocello Street
San Diego, CA 92117"

I don't even have an iPhone. How do I report this guy?

Delete


by an anonymous user from: Bedminster, New Jersey, United States

I received a fake e-mail and did click. What should I do now?

Delete


by info

Change your password. And, if you have entered your credit card information on the page you were taken to, contact your bank for help.

Delete


by an anonymous user from: Vancouver, British Columbia, Canada

HI all! Thanks for everyone sharing this, especially this BLOG.

This helps everyone who wants to be honest. Here's what I got this morning on my email:

"Dear Client,
You are receiving this emaiI as you have made purchase MARVEL Contest of Champions from the App Store on a computer or device that had not previousIy been associated with your Apple ID on February 17, 2018.
The summary is attached in PDF format in this email.

Best Regards,
Apple Support"

I did NOT click on anything they attached, but went to Google right away and found this BLOG.

Now I'm sharing this with you all.

Thanks again for your help! The Lord bless you all!

Delete


by an anonymous user from: Sunnyvale, California, United States

I have also received a number of emails with the same context. Just trash it, and never open it all the way to the cancellation link. Don't give any information and delete it right away.

Delete


by an anonymous user from: Lihue, Hawaii, United States

I just received a mail from apple for Itunes purchase Order I.D. #BVDL14 and doc.# 173157731405 for $339.98 on February 10, 2018 which I did not purchase. It does not show debited to my account but I will not try to get a refund cause I believe this is a phishing mail for getting financial and personal information on me.
I would like confirmation that this is fraud. Thank you for letting me know.

Delete


by an anonymous user from: Buenos Aires, Buenos Aires F.D., Argentina

I received an email with a receipt attached with a suscription that I did not suscribed. I do not have any Apple device.

"Receipt
APPLE ID
BILLED TO

Valley Stream, NY 11580
USA
TOTAL $99.99
DATE
Feb 09, 2018 ORDER ID
MQ016V84TZ
DOCUMENT NO. 212173919152
iCloud
TYPE
PURCHASED FROM

PRICE
iCloud: 8 TB Storage Plan
Monthly iCloud Storage
App Store $99.99
Subtotal $99.99
Tax
$0.00
TOTAL $99.99
Cancel Order"
.
This email confirms payment for the iCloud storage plan listed above. You will be billed each plan period until you cancel by downgrading to the free storage plan from your iOS device, Mac or PC.

You may contact Apple for a full refund within 15 days of a monthly subscription upgrade or within 45 days after a yearly
payment. Partial refunds are available where required by law.
Learn how to manage your password preferences for iTunes, iBooks, and App Store"

Delete


by an anonymous user from: Conway, South Carolina, United States

I received a receipt for Bigo livestream, which I did not order. I have changed my Apple ID and will contact Apple.

I see this has happened to others, and wonder why Applee did not notify users BEFORE we opened it.

Delete


by info

Here is another scam:

"From: Apple Support
Sent: Thursday, February 15, 2018 10:52 PM
Subject: Re : Your receipt from Apple. - Thursday, February 15, 2018

Dear Client,

You are receiving this emaiI as you have made purchase MARVEL Contest of Champions from the App Store on a computer or device that had not previousIy been associated with your Apple ID on February 15, 2018.

The summary is attached in PDF format in this email.
Best Regards,
Apple Support"

Delete


by an anonymous user from: Portsmouth, England, United Kingdom

Thanks, I received a fake mail and googled to double check - found this page! / Karin

Delete


by an anonymous user from: West Chicago, Illinois, United States

Ha, I got the email and I don't have an Apple! Or itunes!

Delete


by an anonymous user from: Everett, Washington, United States

Have received several of these emails. Deleted them and forwarded one to apple. However we did call the # just to see. Straight from India and got irate when I refused to sucker in. I stated I was going to sue them and they screamed at me. It was hysterically funny.

Delete


by info

Here is another scam:

"From: Apple-Service #29015890
Sent: Wednesday, December 27, 2017 1:47 PM
Subject: Confirmation order from "iCloud Drive" #10210561984

Dear user,

thank you for using apple, we will process your transaction on a few hour. please wait and be patient, you authorised a payment $99.99 to iCloud Drive.

To see full transaction details, open the (pdf).
this is not you? you can cancel the order and follow steps on pdf

thank you,
AppleService"

Delete


by an anonymous user from: Macon, Georgia, United States

Received today, 21 Dec 17, am ignoring it:

"RE :[Notice Mail]: Your account success for Subscription Confirmation Mobile Legend's #642-301.
Apple Notice Purchase Online

Mobile-legend_2(2).pdf (144 KB)

Download Save to OneDrive - Personal
CONGRATULATION !!!

Now you successfully paid subscription Mobile Legend's - Starlight Member's (auto renewal).

Please read your subscription message by opening attachment (pdf). You will be prompted to open (Visit Click here) file or save (download) to your computer.

Sincerely,
The App Store team"

Delete


by an anonymous user from: Castro Valley, California, United States

I have one email like this but I didn't click since I didn't order anything. do I report to apple iTunes? where to ?

Delete


by info

We have already reported it, therefore, just delete the email.

Delete


by info

Here is another scam:

-------- Original message --------
"From: "Orders Confirmations."
Date: 12/6/17 1:40 PM (GMT-05:00)
Subject: Your BIGO LIVE subscription - Live Stream has a recent renewal.

The foƖƖowing subscription confirmation:
BIGO LIVE - Live Stream (1 month) - December 02, 2017
Ɩf you did not authorize this purchase,PƖease canceƖ this subscription.
You can canceƖ the Subscription Confirmation process by tapping the foƖƖowing attachment (PDF)"

Delete


by an anonymous user from: Sunnyvale, California, United States

What should I do if I was stupid enough to open it and give them all of my information ...social security number, credit card info, mother's maiden name. Please help!

Delete


by an anonymous user from: Jacksonville, Florida, United States

HI anon,

You'll want to update your password for your Apple ID (your iTunes / App store account), as well as the passwords for any other sites / services you use where you are using the same password or a similar password.


You may also find it beneficial to sign up for an Identity Theft monioring service for the next 6 months - 1 year. These services can alert you if anything odd happens, such as new loans or credit cards being taken out in your name.

Going forward, always use common sense and caution when interacting with any unexpected emails like this. When looking closely at this scam emails, it's very easy to determine that they are 100% fake:

- Look at the actual email address the message is being sent from. Notice that this email is not coming from Apple (example: kjddgf341jdfbka-jsbadjhsadb-refundordersbigo.info).

- Notice that the email is very short, and contains no long legal disclaimer at the bottom of the email.

- Notice that the Subject line (example: 'Orders confirmation') and body of the email are simple, unprofessional and completely different from an actual Apple order receipt email.

- Notice that the email does not address you (i.e. 'Dear John,') and does not have a closing (i.e. 'Thank you, Apple App Store').

- Notice that the attachment on the email (which you should not open or download! If you did, delete it) contains a random and unprofessional file name (example: jdfhjHG13-Invoice.docx)

- While similar to a real Apple Invoice attachment, notice that this attachment contains no long legal disclaimer.

Good luck my friend! If you change your passwords immediately and watch all of the financial activity in your name, you should be fine.

Delete


by info

Report it to your bank and the police. And, change your passwords.

Delete


by an anonymous user from: Lake Elsinore, California, United States

Another one:

"Thanks for your purchase

Dear Client,

You’ve purchased a product from Mobile Legend: Bang Bang on App Store.
This is receipt your payment from YoungJoy Technology Limited.

Document ID Date Confirmed Status
2511201709158273 Sunday, November 26, 2017
SUCCESSFUL

Mobile Legend: Bang Bang 5000 Diamonds
Type: Purchase in App
Qty: 1
Price: $99.99

VIEW RECEIPT

Didn't authorized this transaction?
Visit the App Store help center to dispute this transaction.

If you have any questions about this information, you can visit App Store help Center

Learn how to manage account preferences for iTunes, iBooks, and App Store Purchases
Help & Contact
Security
Privacy & Policy

© 2017 All Right Resrved. Apple Distribution International, Hollyhill Industrial Estate, Hollyhill, Cork, Ireland."

Delete


by info

Here is another scam:

"From: Order verif
Date: November 22, 2017 at 11:05:38 AM CST
Subject: Orders confirmation

Your Order Number is: 4038076

Item: Diamonds Bigo
Total : 2552 diamond
Total Price:$88.89

If you did not make this purchase please confirm the order cancellation via file we have provided.
please fill in all the data we have provided so we can process your request"

Delete


by an anonymous user from: Newark, New Jersey, United States

received email saying I owed $59.09. Came from icloud, billed on apple device for spotify premium 1 year. First, they bill monthly, not yearly. Second, the amount made no sense. Third, the statement said it was a new account, also inaccurate. So tired of these scams.

Delete


by an anonymous user from: Venice, Florida, United States

I know I did not order an app but don’t remember if I opened it. What do I do?

Delete


by info

It is a scam. You do not need to do anything. But, if you have clicked the link in the email, you need to change your password.

Delete


by an anonymous user from: Mt Prospect, Illinois, United States

Here is another scam:

"Order # MXDTT6680Y in Iphone 5S - Thanks For Purchase.

Date: 11 Sep 2017
Transaction: MXDTT6680Y
Order number: #115168412066

If you have not recently purchased a product or application on a iPhone" With your AppIe ID and think of your access account,
Please read our link and follow to insure instruction your account.

Sincerely,
AppIe department account

Copyright © 1998-2017. 2211 N 1st St, San Jose, USA All rights reserved"

Delete


by info

Here is another scam:

-----Original Message-----
"From: service-appstore.com
Sent: Sun, Nov 5, 2017 4:32 am
Subject: ORDER ID W10098921165 : Action Required

Apple Receipt

Thank you for buying

BILLED TO Apple ID TOTAL $44.90 INVOICE DATE 05 Nov 2017 ORDER ID W10098921165 DOCUMENT NO. AAA25BB839MS

The subscription period will automatically renew unless you turn it off no longer than 24 hours before the end. of the curent period. To cancel auto-renewaI or manage your subscription, click iTunes Payment Cancellation.
We detect unauthorize purchase for this invoice. If you did not authorize this purchase, please visit
CANCEL

iTunes Store
TYPE PURCHASED FROM PRICE

Netflix, By Netflix Acc
NetFIix, By NetFIix, Inc.

Renewal Purchase In-iTunes Store iPhone $44.90

Regards,
Team iTunes Store

Apple ID Summary Purchase History Terms of Sale Privacy Policy
Copyright � 2017 iTunes
All rights reserved"

Delete


waiting