Technology

Apple app password scam email warning

Published

1 month ago

February 24, 2026

NEWYou can now listen to Fox News articles!

You open your inbox and see a subject line from Apple. It says an app-specific password was generated for your account. Then your stomach drops.

The email claims you authorized a $2,990.02 PayPal payment. It even includes a confirmation number. It urges you to call a support number right away. There is just one problem. You never did any of this.

If that sounds familiar, you are likely looking at a classic Apple impersonation scam.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

Scammers are using Apple branding and urgent language to trick victims into calling a fake support number. (Kevin Carter/Getty Images)

What the fake Apple email says

The message claims:

An app-specific password was generated
A large PayPal payment was approved
You should call the listed phone number to report an unauthorized transaction

At first glance, it looks polished. It uses Apple branding. It mentions Apple Support. It includes a confirmation code. However, once you slow down and read it carefully, the red flags jump out.

Red flags in the Apple app-specific password scam email

Before you panic or pick up the phone, take a closer look at these warning signs that expose this Apple app-specific password scam email.

1) The ‘To’ address is not you

The “To” field shows an email address that is not the recipient’s actual address. That is a huge warning sign. Legitimate Apple security emails are sent directly to the Apple ID email on file. If the visible recipient address is different from yours, the message was likely mass-mailed or spoofed. Scammers blast these emails to thousands of addresses at once. They do not customize the recipient line properly. That mismatch alone is enough to treat the message as fraudulent.

2) The sudden $2,990 charge

Scammers love big numbers. A charge close to $3,000 is designed to trigger panic. When people feel fear, they act fast. That is exactly what the criminals want.

3) The ‘call this number now’ trick

The email pushes you to call a specific phone number. That number does not belong to Apple. Real Apple security emails tell you to visit your account directly. They do not pressure you to call a random support line.

If you call, the scammer may:

Ask for your Apple ID password
Request remote access to your computer
Tell you to move money to “secure” your account

That is how the real damage begins.

4) Bold links that push you to click

The email includes bold links such as Apple Account and Apple Support. They are designed to look official and trustworthy. However, scammers often hide malicious URLs behind legitimate-looking text. When you hover over the link, the actual destination may be a completely different website. That is why you should never click links inside a suspicious email. Instead, open a new browser window and type the official website address yourself.

5) Mixed messages about passwords and payments

The subject mentions an app-specific password. The body suddenly talks about a PayPal transaction. That mismatch is a major warning sign. Scammers often combine multiple fears into one message to increase urgency.

6) Generic greeting

The email opens with “Dear Customer.” Apple typically addresses you by your name. Generic greetings are common in bulk phishing emails.

SPYWARE CAN HIGHJACK YOUR PHONE IN SECONDS

A fake Apple email claiming a $2,990 PayPal charge is targeting inboxes in a new impersonation scam. (Qilai Shen/Bloomberg via Getty Images)

More subtle signs this is a scam

There are several additional details that help confirm this is not real.

The reply-to address may look legitimate at first glance

In this case, the Reply-To field shows appleid-usen@email.apple.com, which appears to be an official Apple domain. However, a familiar-looking domain does not automatically prove an email is legitimate. Scammers can spoof visible sender information. They can manipulate display names and certain header fields so a message appears to come from a trusted company. Most people never see the deeper technical authentication details, such as SPF, DKIM or DMARC validation. That means a legitimate-looking sender address can still appear in a fraudulent message. When evaluating a suspicious Apple app-specific password email, weigh all the red flags together, not just the reply-to address.

If the email also includes:

A mismatched “To” field
A large unexpected payment
An urgent phone number
Mixed messaging about passwords and PayPal

Those warning signs matter far more than a familiar-looking domain.

The payment language feels forced

The email says: “You authorized a USD 2,990.02 payment to apple.com using PayPal.” That wording feels stiff and unnatural. Apple receipts usually reference specific products, subscriptions or invoice details. They do not vaguely reference a large PayPal payment tied to a password notification. The mismatch between a password alert and a major payment should raise suspicion immediately.

The masked email formatting looks odd

The message shows a masked address with dots and an unusual domain, such as relay.quickinvoicesus.com. That is not standard Apple formatting. Apple typically references your Apple ID directly, not an unrelated invoice-style domain. That strange domain inclusion is another strong indicator that this email is fraudulent.

The pressure to act fast

The message urges you to call immediately to report an unauthorized transaction. High urgency is a hallmark of phishing. Legitimate companies encourage you to log in securely to your account. They do not rush you into calling a third-party phone number. When you feel rushed, pause. Scammers rely on speed and emotion.

What this scam is really trying to do

This is a refund scam disguised as a security alert.

The goal is simple. Get you to call the fake support number. Once you are on the phone, the scammer may:

Ask for your Apple ID password
Request remote access to your computer
Guide you through fake refund steps
Steal banking or PayPal information

In many cases, victims lose far more than the fake $2,990 charge mentioned in the email.

How to check your Apple account safely

If you receive this type of message, pause. Then take control. Instead of clicking links in the email:

Open a new browser window
Type appleid.apple.com directly into the address bar
Log in and review your account activity

If you did not generate an app-specific password and you see no suspicious charges, you are safe. You can also check your PayPal account directly by typing paypal.com into your browser. Never rely on links or phone numbers inside a suspicious email.

Apple app-specific password scam email checklist

Use this simple checklist the next time you get a scary email:

The “To” field does not match your email
The greeting says Dear Customer
There is a large unexpected charge
You are told to call a number immediately
The topic feels mismatched, such as password plus payment

If several of these appear together, you are almost certainly dealing with a scam.

Why Apple and PayPal impersonation scams keep working

Apple has billions of users. PayPal has hundreds of millions more. Both brands are trusted, widely used and connected to sensitive financial information. When criminals attach Apple’s name to a message, people pay attention. When they add PayPal and a large dollar amount, the fear intensifies. That combination is powerful. It blends account security concerns with financial panic. Many people react before they pause to verify the details. That split second of fear is exactly where scammers make their money.

“PayPal does not tolerate fraudulent activity, and we work hard to protect our customers from evolving phishing scams,” a PayPal spokesperson told CyberGuy. “We always encourage consumers to practice vigilance online and to learn how to spot the warning signs of common fraud. We recommend reviewing our best practice tips for avoiding phishing schemes on the PayPal Newsroom, and contacting Customer Support directly through the PayPal app or our Contact page for assistance if you believe you have been targeted by a scam.”

CyberGuy also reached out to Apple for comment.

TAX SEASON SCAMS 2026: FAKE IRS MESSAGES STEALING IDENTITIES

The fraudulent message combines an app-specific password alert with a PayPal charge to create panic. (Christian Charisius/picture alliance via Getty Images)

How to protect yourself from Apple phishing emails

You can reduce your risk from an Apple app-specific password scam email with a few smart habits. These steps protect more than just your Apple account. They protect your entire digital life.

1) Use two-factor authentication

Enable two-factor authentication (2FA) on your Apple ID, PayPal and email accounts. Even if someone guesses your password, they still cannot log in without the second verification step. That extra layer blocks most account takeover attempts.

2) Never click links or call numbers in suspicious emails

If an email tells you to call support or click a link, stop. Instead, open a new browser window and type the official website address yourself. Go directly to appleid.apple.com or paypal.com. Also, make sure you have strong antivirus software installed on your devices. Strong antivirus tools can detect malicious links, block phishing sites and warn you before you land on a fake login page. That protection matters because one click on the wrong link can expose login credentials or install hidden malware. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

3) Watch for urgency and fear tactics

Scammers push urgency. They use large dollar amounts and phrases like unauthorized transaction to rush you. Pause when you feel panic. Review the details carefully. Legitimate companies do not pressure you into instant action.

4) Keep your devices updated

Install software updates on your phone and computer as soon as they become available. Security patches fix vulnerabilities that attackers exploit. Outdated software makes phishing and malware attacks easier to pull off.

5) Use a password manager and strong, unique passwords

Do not reuse passwords across accounts. If one site gets breached, reused passwords put everything else at risk. A password manager generates long, complex passwords and stores them securely. That way, even if scammers trick you into entering one password somewhere, it will not unlock your other accounts.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

6) Reduce your exposed personal information

Scammers often find your email address and personal details through data broker sites. Using a reputable data removal service can reduce how much of your personal information is publicly available online. When less of your data floats around the internet, criminals have fewer tools to target you with convincing phishing emails. Less exposure means fewer personalized scams landing in your inbox. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

7) Report the phishing email

Forward suspicious Apple impersonation emails to reportphishing@apple.com. You can also mark the message as phishing in your email provider. Reporting scams helps improve filters and protect other people from falling victim.

8) Monitor your financial accounts

Even if you did not click anything or call the number, review your bank, PayPal and Apple accounts for unusual activity over the next few days. Early detection limits damage. The faster you spot fraud, the easier it is to reverse.

9) Consider freezing your credit if information was exposed

If you entered personal information or downloaded anything suspicious, consider placing a free credit freeze with Equifax, Experian and TransUnion. A credit freeze prevents criminals from opening new accounts in your name. To learn more about how to do this, go to Cyberguy.com and search “How to freeze your credit.”

Kurt’s key takeaways

If you received an Apple app-specific password email with a $2,990 charge you did not authorize, trust your instincts. It is almost certainly a scam. Do not call the number. Do not click the links. Go directly to your official account pages and check for yourself. A few calm minutes can save you thousands of dollars and hours of stress.

When phishing scams use trusted brands like Apple so easily, is the tech industry truly staying ahead of cybercriminals? Let us know your thoughts by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:apple cybercrime email Featured

Click to comment

Technology

Judge sides with Anthropic to temporarily block the Pentagon’s ban

Published

5 hours ago

March 27, 2026

Press Room

Judge sides with Anthropic to temporarily block the Pentagon’s ban

After Anthropic’s weeks-long standoff with the Pentagon, the company won one milestone: A judge granted Anthropic a preliminary injunction in its lawsuit, which sought to reverse its government blacklisting while the judicial process plays out.

“The Department of War’s records show that it designated Anthropic as a supply chain risk because of its ‘hostile manner through the press,’” Judge Rita F. Lin, a district judge in the northern district of California, wrote in the order, which will go into effect in seven days. “Punishing Anthropic for bringing public scrutiny to the government’s contracting position is classic illegal First Amendment retaliation.”

A final verdict could be weeks or months out.

Anthropic spokesperson Danielle Cohen said in a Thursday statement, “We’re grateful to the court for moving swiftly, and pleased they agree Anthropic is likely to succeed on the merits. While this case was necessary to protect Anthropic, our customers, and our partners, our focus remains on working productively with the government to ensure all Americans benefit from safe, reliable AI.”

“I do think this case touches on an important debate,” Judge Lin said during the Tuesday hearing. “On the one hand, Anthropic is saying that its AI product, Claude, is not safe to use for autonomous lethal weapons and domestic mass surveillance. Anthropic’s position is that if the government wants to use its technology, the government has to agree not to use it for those purposes. On the other hand the Department of War is saying that military commanders have to decide what is safe for its AI to do.”

On Tuesday, Judge Lin went on to say, “It’s not my role to decide who’s right in that debate… The Department of War decides what AI product it wants to use and buy. And everyone, including Anthropic, agrees that the Department of War is free to stop using Claude and look for a more permissive AI vendor.” She added, “I see the question in this case as being … whether the government violated the law when it went beyond that.”

It all started with a memo sent by Defense Secretary Pete Hegseth on Jan. 9, calling for “any lawful use” language to be written into any AI services procurement contract within 180 days, which would include existing contracts with companies like Anthropic, OpenAI, xAI, and Google. Anthropic’s negotiations with the Pentagon stretched on for weeks, hinging on two “red lines” that the company did not want the military to use its AI for: domestic mass surveillance and lethal autonomous weapons (or AI systems with the power to kill targets with no human involvement in the decision-making process). The rollercoaster series of events that followed has included a barrage of social media insults, a formal “supply chain risk” designation with the potential to significantly handicap Anthropic’s business, competing AI companies swooping in to make deals, and an ensuing lawsuit.

With its lawsuit, Anthropic argues that it was punished for speech protected under the First Amendment, and it’s seeking to reverse the supply chain risk designation.

It’s rare, and potentially even unheard of until now, for a US company to be named a supply chain risk, a designation typically reserved for non-US companies potentially linked to foreign adversaries. Anthropic’s designation as such raised eyebrows nationwide and caused bipartisan controversy due to concerns that disagreeing with a presidential administration could potentially lead to outsized retribution for a business in any sector.

Anthropic’s own business has been significantly affected by the designation, according to its court filings, which say that it has “received outreach from numerous outside partners … expressing confusion about what was required of them and concern about their ability to continue to work with Anthropic” and that “dozens of companies have contacted Anthropic” for guidance or information about their rights to terminate usage. Depending on the level to which the government prohibits its contractors’ work with Anthropic, the company alleged that revenue adding up to between hundreds of millions and multiple billions could be at risk.

During Tuesday’s hearing, both companies had a chance to respond to Judge Lin’s questions, which were released in a document the day prior and hinged on matters like whether Hegseth lacked authority to issue certain directives and why Anthropic was named a supply chain risk. The judge also asked, in her pre-released questions, about the circumstances under which a government contractor could face termination for using Anthropic’s technology in their work — for instance, “if a contractor for the Department uses Claude Code as a tool to write software for the Department’s national security systems, would that contractor face termination as a result?”

On Tuesday, the judge also seemed to admonish the Department of War for Hegseth’s X post that caused a lot of widespread confusion per Anthropic’s earlier court filings, stating that “effective immediately, no contractor, supplier, or partner that does business with the United States military may conduct any commercial activity with Anthropic.”

“You’re standing here saying, ‘We said it but we didn’t really mean it,’” Judge Lin said during the hearing, later pressing on the question of why Hegseth wrote the above barring contractors from working with Anthropic instead of just simply designating Anthropic as a supply chain risk.

In a series of questions on Tuesday, Judge Lin asked whether the Department of War plans to terminate contractors on the basis of their work with Anthropic if it’s separate from their work with the department, and a representative for the Department of War responded, “That is my understanding.”

Judge Lin asked, “Let’s say I’m a military contractor. I don’t provide IT to the military. I provide toilet paper to the military. I’m not going to be terminated for using Anthropic — is that accurate?” The representative for the Department of War responded, “For non-DoW work, that is my understanding.” But when the judge asked whether a military contractor providing IT services to the Department of War, but not for national security systems, could be terminated for using Anthropic, the representative for the Department of War did not give a concrete answer.

During the hearing, Judge Lin cited one of the amicus briefs, which she said used the term “attempted corporate murder.” She said, “I don’t know if it’s ‘murder,’ but it looks like an attempt to cripple Anthropic.”

“We are continuing to be irreparably injured by this directive,” a lawyer for Anthropic said during the hearing, citing Hegseth’s nine-paragraph X post.

In a recent court filing, the Department of Defense alleged that Anthropic could ostensibly “attempt to disable its technology or preemptively alter the behavior of its model either before or during ongoing warfighting operations” in the event it felt the military was crossing its red lines — a theoretical situation that the Pentagon said it deemed an “unacceptable risk to national security.” The judge’s pre-released questions seem to challenge that statement, or at least request more information on it, stating, “What evidence in the record shows that Anthropic had ongoing access to or control over Claude after delivering it to the government, such that Anthropic could engage in such acts of sabotage or subversion?”

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.

Hayden Field

Technology

Drone food delivery launches in New Jersey

Published

5 hours ago

March 27, 2026

Press Room

Drone food delivery launches in New Jersey

NEWYou can now listen to Fox News articles!

You place a food order, check your phone, and instead of a driver pulling up, a drone lowers your meal to your front yard. That scenario is already playing out in the Garden State. But before you get too excited, this is still a limited test.

Grubhub just launched New Jersey’s first drone-powered food delivery pilot, and it is getting plenty of attention. The three-month program kicked off on March 18 in Green Brook, just a few miles from Middlesex. If you live within about 2.5 miles of the location, you may be able to try it yourself.

Even better, you will not pay anything extra to choose the drone option.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter

YOUR DOORDASH ORDER MIGHT ARRIVE FROM THE SKY AS DRONE DELIVERIES TAKE OFF

Grubhub launches a three-month drone delivery test in New Jersey, offering faster drop-offs with no added cost. (Grubhub)

How the drone delivery program works

The program is based out of Wonder’s Green Brook location, which operates a multi-restaurant kitchen. That means your order can come from one of 15 different food concepts, all prepared in the same place.

Here is how it works step by step:

You order through the Grubhub app
You select drone delivery if you are eligible
Your food is prepared and secured by trained staff
A drone flies it along a pre-approved route
The order is lowered safely to the ground using a tether

You can track everything in real time, just like a regular delivery. It feels familiar, but the final step looks very different.

Why this could be faster than your usual delivery

Timing matters when you are hungry. That is where drones may have a real advantage. Unlike drivers, drones do not deal with traffic, stoplights or parking. They fly directly to your location using optimized flight paths.

Grubhub says deliveries should arrive faster than traditional methods. While that will vary based on conditions, the goal is simple. Less waiting, more eating. This test will help the company see if that promise holds up in real neighborhoods.

AIR TAXIS IN THE US COULD LAUNCH THIS SUMMER

New Jersey residents within range can order food by drone, with real-time tracking and tethered drop-offs. (Grubhub)

The tech behind the delivery drones

The program uses the DE-2020 drone from Dexa, a company that specializes in autonomous delivery systems.

This is not a hobby drone. It is a fully automated aircraft built for commercial use.

Key features include:

FAA-certified operations for safety and compliance
Secure communication systems during flight
Controlled drop-off using a tether system
Pre-planned routes to reduce noise and disruption

Before each flight, crews check that food is packaged and secured properly. That step helps prevent spills or issues mid-air. In short, there is a lot more going on behind the scenes than a simple takeoff and landing.

We reached out to Grubhub, and a spokesperson shared the following statement:

“Our partnership with Dexa represents a major step forward in Grubhub’s commitment to delivery innovation,” said Abhishek “PJ” Poykayil, SVP of customer delivery operations at Wonder and Grubhub. “By connecting Grubhub’s marketplace expertise, Wonder’s innovative mealtime platform, and Dexa’s expansive drone technology, we’re proud to introduce a faster and more efficient way for New Jersey diners to experience food delivery without compromising safety or reliability.”

We also reached out to Dexa for more insight into the technology behind the program. CEO and founder Beth Flippo shared the following with CyberGuy:

“At Dexa, we’re proud to be powering the underlying autonomous technology that enables this new generation of on-demand delivery. Our partnership with Grubhub brings together their industry-leading logistics network with our advanced autonomy platform, which is designed to safely navigate complex environments, optimize real-time routing, and operate reliably without the need for continuous human intervention. This is a meaningful step toward a future where autonomous systems are woven seamlessly into everyday life, from delivering food and goods to supporting transportation, infrastructure and critical services. As consumers continue to expect faster, more efficient and more sustainable options, autonomy will play a central role in meeting those expectations at scale.”

FORGET DRONES, THIS STREET-SMART ROBOT COULD BE FUTURE OF LOCAL DELIVERIES

Autonomous drones designed by Dexa deliver meals from a central kitchen, bypassing traffic in a new suburban pilot program. (Grubhub)

Why companies are pushing drone delivery now

This move is not random. It is part of a bigger shift in how companies think about delivery. You and I want speed, convenience and reliability. At the same time, businesses want to reduce costs and scale faster. Drone delivery sits right in the middle of that.

It removes many of the delays tied to traditional delivery. It also opens the door to new models, especially in suburban areas where distances are manageable.

We are already seeing this play out in other parts of the country. Companies like Wing, backed by Google’s parent company Alphabet, have been testing and expanding drone deliveries for food, retail and small packages in select U.S. markets.

This New Jersey test is another step in that direction, and it shows how quickly the space is evolving.

What this means to you

Even if you are not in Green Brook, New Jersey, this still matters. Here is why:

You may get faster deliveries

If this works, shorter delivery times could become the new normal.

You could see more delivery options

Apps may soon offer choices like driver, robot or drone depending on your location.

It could change delivery costs

Right now, there is no added fee. In the future, pricing models may shift based on speed and demand.

Your neighborhood may see more drones

That raises questions about noise, safety and privacy that communities will need to address.

This is not only about food. The same technology could expand to groceries, retail and even medical supplies.

Take my quiz: How safe is your online security?

Think your devices and data are truly protected? Take this quick quiz to see where your digital habits stand. From passwords to Wi-Fi settings, you’ll get a personalized breakdown of what you’re doing right and what needs improvement. Take my Quiz here: Cyberguy.com

Kurt’s key takeaways

It is easy to see drone delivery as some sort of cool experiment. But something bigger is starting to take shape right above us. For the first time, the sky is becoming part of everyday delivery. Today it is takeout. Tomorrow it could be groceries, last-minute essentials or even urgent supplies. If this technology proves reliable, and we get comfortable with it, the way you get what you need could change faster than you expect. So the next time you hear a faint buzz overhead, you may want to look up. It might not be a plane. It could be your dinner on the way. The real question is not if drones will become part of daily life. It is how soon you will be tracking one to your doorstep.

Would you trust a drone to deliver your next meal? Why or why not? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Technology

Netflix is raising prices again

Published

17 hours ago

March 26, 2026

Press Room

Netflix’s prices just went up, with its cheapest, ad-supported tier now reaching $8.99 / month (up from $7.99 / month), according to an updated support page spotted earlier by Android Authority. The standard and premium plans are also getting a hike, going from $17.99 to $19.99 / month and $24.99 to $26.99 / month, respectively.

Netflix didn’t share its reasoning for the price hike this time around, as it last cited delivering “more value for our customers.” It’s also unclear when the price hike will go into effect for existing subscribers. The Verge reached out to Netflix with a request for comment but didn’t immediately hear back.