Opening the attachment reveals what appears to be a subscription confirmation receipt from Apple. The receipt supposedly confirms that you have purchased a subscription for a popular music app and Apple will charge you an ongoing monthly fee.
The receipt explains that if you didn’t order the subscription or you think an unauthorised person has accessed your account, you should click a “cancel” link.
However, Apple did not send the email. Instead, it is a phishing scam designed to trick you into handing over your personal information to online criminals.
Clicking the link opens a fraudulent website that has been built to emulate the official Apple site. The fake webpage first asks you to log in with your Apple ID.
Next, it asks you to complete a ‘Cancel Subscription” form. The form requests your name and contact details, your credit card numbers, and other identifying information.
After you submit the form, the site redirects you to the real Apple website.
Meanwhile, the criminals can collect the information you supplied and use it to hijack your Apple account, conduct fraudulent transactions with your credit card, and, possibly, steal your identity as well.
Apple phishing scams like this one are very common. If you receive one, do not click any links or open any attachments that it contains.
The Apple website includes information about identifying and reporting these phishing emails.