Fake Apple billing email doing the rounds
Emails with the subject "important notice" are impersonating Apple and pushing you to update billing details after claiming your account has been locked.
You could receive an email with the subject "important notice" that reads like a message from Apple customer support. It tells you there is a problem with the payment method linked to your Apple ID, says your account has been temporarily locked, and urges you to update your billing details to restore access.
What makes this convincing is that the sender domain, ben-hur.co.il, can appear technically legitimate to email systems. The usual checks passed, which means the message may slip past filtering even though it has nothing to do with Apple. The real giveaway is the story itself. Apple billing alerts should come from Apple owned infrastructure, not an unrelated overseas domain with no established connection to the brand it claims to represent.
The attacker is after your Apple ID credentials and likely your payment information. If you click through and enter details, you could hand over account access, expose stored cards, and give the attacker a foothold for further fraud or account recovery abuse.
This campaign has been seen circulating across multiple NZ organisations in the last day. Treat any Apple themed billing warning that arrives from an unrelated domain as suspicious, even if it looks polished and passes basic email checks.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at Apple themed emails asking you to fix billing or unlock an account. If the sender domain is unrelated to Apple, treat it as suspicious.
- Do not: Click links or enter passwords or card details from an unsolicited email, even if the message appears legitimate in your inbox.
- Verify: If you are concerned about your Apple account, go directly to Apple through its official website or app and check your account there.
- Report: Send suspicious messages to your IT provider or internal security team so they can block the sender and review whether anyone engaged with it.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Apple message looks like, the real sender domain, the real link destination, and where to report a fake.