AARP Hearing Center
New Foldable iPhone Scam: Don’t Click on That Preorder Link
A fake Apple site offers a $500 voucher. Opening it could expose your passwords and photos
3-minute read
Key takeaways
- A fake website promises a $500 voucher and AppleCare+ coverage, with a fake preorder form.
- The scam attempts to access saved passwords, Apple Notes, photos and financial information on your phone.
- Apple says updated iPhones are protected against the reported attacks. Check for updates under Settings > General > Software Update.
A fake website offering early orders for Apple’s new foldable iPhone Duo could put passwords, photos and other personal information at risk, according to cybersecurity company Malwarebytes. Simply opening the page on an iPhone that is missing security updates could allow criminals to break into the device.
Apple says phones with up-to-date software are protected against the reported attacks, so make sure yours is updated.
More Ways to Benefit
- Related Benefit 1
- Related Benefit 2
- Related Benefit 3
- Related Benefit 4
- Related Benefit 5
The fraudulent site promises a $500 voucher and free AppleCare+ coverage to lure shoppers into reserving an iPhone Duo. But Apple doesn’t begin accepting preorders for its first foldable phone until Oct. 16. And the scam site offers colors that Apple does not; as of now, the only colors available are Night Sky and Star White.
"Don't click on links that promise a free phone or deeply discounted one. They are probably after nothing but your personal and financial information," says Amy Nofziger, the senior director of victim support at the AARP Fraud Watch Network.
How the scam works
Malwarebytes, which published its findings Sept. 29, says the site copies Apple’s logo and copyright notice to look legitimate. A countdown clock pressures visitors to act quickly.
The page asks for a name, email address and phone number. Filling out the form doesn’t place an order. And leaving it blank doesn’t prevent the attack: Hidden software begins trying to break into the phone as soon as the page opens.
The attack uses a hacking tool called DarkSword to exploit weaknesses in older iPhone software. If it succeeds, criminals could gain access to saved passwords, personal notes, photos and messages. It also targets information from cryptocurrency wallets that could put money at risk.
Malwarebytes examined the attack’s code but did not test it on an iPhone or confirm that it had stolen anyone’s information.
How to protect yourself
Update your iPhone. Open Settings, tap General, then Software Update. Install the latest update available for your phone and turn on Automatic Updates. Apple has released fixes for the security weaknesses involved in the reported attacks.
Check offers directly. Malwarebytes advises going straight to Apple or a retailer you know instead of following unfamiliar links in emails, text messages, advertisements or social media posts.
To learn about the foldable iPhone Duo or to order when preorders open, type Apple’s website address, https://www.apple.com/, directly into your browser’s address bar.
What to do if you opened the fake website
Malwarebytes recommends these steps:
Update your iPhone and restart it. Restarting may stop the malicious software from running, but it cannot undo any information theft.
Change passwords that may have been exposed. Use another phone or computer you trust. Start with your email, Apple Account and banking accounts.
Turn on two-factor authentication. This requires an additional step to verify your identity when you sign in, helping protect your account if someone steals your password.
If you use a cryptocurrency wallet on the affected phone, Malwarebytes also recommends securing those funds from a trusted device. If you have an account with a cryptocurrency exchange, contact the exchange for help.
Report the scam. Report the scam to the FBI’s internet Crime Complaint Center (IC3.gov). Not every complaint leads to enforcement action, but the information can help officials spot trends, warn the public and sometimes identify the criminals.
Find support. Call the AARP Fraud Watch Network’s toll-free Helpline (877-908-3360), where trained volunteers provide victims and family members with support and guidance on next steps.
The key takeaways were created with the assistance of generative AI. An AARP editor reviewed and refined the content for accuracy and clarity.
AARP Membership
Join AARP for only $15 per year with automatic renewal. Get instant access to members-only products and hundreds of benefits, a free second membership, and a subscription to AARP The Magazine.
More From AARP
Consumers Receiving Fake Product Recall Notices
Criminals impersonate retailers with recall alerts to steal money or information
What to Know About Amazon’s Scam Detection Tool
The often impersonated company is using Alexa to help customers spot fraud
Fraud Wars Video: A Fake Fraud Alert Leads to Theft
A criminal pretending to be from Marcia Hubelbank’s bank stole her savings