Dodgy Apple billing email doing the rounds
A phishing email is circulating across NZ that pretends to be from Apple and pressures you to fix a payment problem.
You could receive an email with the subject line important notice, appearing to come from an Apple-branded sender, warning that there is a problem with your payment method. It tells you your current payment could not be processed and pushes you to review your payment details so you can keep using Apple services and subscriptions. The goal is to make you act quickly before you stop to question it.
What gives it away is that the sending domain, loretobay902.com, has nothing to do with Apple, even though the message tries to look legitimate. Parts of the email authentication passed, which can help it slip through filters, but the email system could not fully verify who really sent it. That means the message may look more trustworthy than it is. The domain also has no established history as a recognised sender for Apple billing notices, which is a strong warning sign.
If you click through or reply, the attacker is likely trying to steal your login details, payment information, or both. That can lead to unauthorised charges, account takeover, or follow-on fraud against your business. If your staff use the same or similar passwords elsewhere, one email can quickly become a wider compromise.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Inspect the sender domain carefully. Apple billing emails should not come from unrelated domains like loretobay902.com.
- Do not: Click links, open payment pages, or enter card details from an unsolicited billing email.
- Verify: Go directly to your Apple account through the official app or website you source yourself, and check your billing status there.
- Report: Flag the message to your IT provider or internal security contact so filtering and blocking can be updated.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.