Is this spam? Invoice from apple?

fcmisc

I have received an emailed invoice from Apple. I did not know I have an Apple account. If I do have an Apple account, I do not actively use it.

Anyway, I received this invoice from them, and am wondering if it means someone has done a fraudulent charge on my credit card or are they phising for me to click the link. How can I tell?



Invoice
APPLE ID
xxx@xxx.com BILLED TO
xxx@xxx.com TOTAL
£29.94
INVOICE DATE
16 Aug 2016 SEQUENCE NO.
1-85714114754
ORDER ID
MD98273482 DOCUMENT NO.
857741475924
App Store TYPE PURCHASED FROM PRICE
Sing! Karaoke by Smule, VIP All Access Pass (Automatic Renewal) Sing! Karaoke by Smule, VIP All Access Pass (Automatic Renewal)
Monthly | 31 Aug 2016
Report a Problem In-App Purchase £29.94
Inclusive of VAT at 20%
VAT charged at 20% £1.66
TOTAL £29.94

pappa_golf

either you have or you have not got an apple account , and if you have


a: is your credit card/debit card linked to it?
b: has any monies gone from your account?

Neil_Jones

If in doubt do not click on anything.
Monitor your bank accounts and if you do see a transaction for £29.94 flag it up as fraudulent.

It's almost certainly a Phishing mail.

fcmisc

I found that I do have an apple account. It has a credit card registered to it that expired in June, so hopefully I am safe. However, I can't work out how to view my recent order history. I am just using the web address here:

http://www.apple.com/itunes/

wongataa

fcmisc wrote: »

I have received an emailed invoice from Apple. I did not know I have an Apple account. If I do have an Apple account, I do not actively use it.

Anyway, I received this invoice from them, and am wondering if it means someone has done a fraudulent charge on my credit card or are they phising for me to click the link. How can I tell?

Is the email actually from Apple? Look at the from email address and the headers to see where it is actually from.

What is the address of the link. Hover the cursor over it to see what the actual address is. Is it an Apple address. I suspect that a genuine email from Apple wouldn't invite you to click on a link.

20aday

In App purchase by the sounds of it.

Any kids with an iPad/iPhone who are using your iCloud account?

Just because the credit card is expired doesn't necessarily mean you won't be billed...

If you log in here: http://reportaproblem.apple.com and sign if with the email address/password.

From there you can view the purchase and contact Apple for a refund.

Edit: email should originate from no_reply@email.apple.com

fcmisc

wongataa wrote: »

Is the email actually from Apple? Look at the from email address and the headers to see where it is actually from.

What is the address of the link. Hover the cursor over it to see what the actual address is. Is it an Apple address. I suspect that a genuine email from Apple wouldn't invite you to click on a link.

Apologies for this messy post, but here is the message source with my email address XXX'd out. It claims to be from ecommerce.apple.com, though I guess that could be forged



x-store-info:J++/JTCzmObr++wNraA4Pa4f5Xd6uensydyekesGC2M=
Authentication-Results: hotmail.com; spf=none (sender IP is 64.59.134.9; identity alignment result is pass and alignment mode is relaxed) smtp.mailfrom=order5749@ecommerce.apple.com; dkim=none (identity alignment result is pass and alignment mode is relaxed) header.d=ecommerce.apple.com; x-hmca=none header.id=order5749@ecommerce.apple.com
X-SID-PRA: order5749@ecommerce.apple.com
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0z
X-Message-Info: NhFq/7gR1vSbhX/ZiOuBn+9pbVGvmuWevXXIKvwTRgL9hMHJMHdkLjsXU7jS0Fl3fYKhrY5E866GXQSt1jkV+XbgyD3EvcLRxYNROrNULXdV/A1MEbLQ4lT9cRJNX5WClIz0k3RJisrf!!!toeuev4AIXD2pJPoVmof1wHhsoCr49/tQI1uAsn4L0iG+PwrSORmHgC/AH6wwCdYXtgQ4N+IPrkFEIWABGdeZND6cxkQKHXmpcu7xnY4Da9Ta+cHx
Received: from smtp-out-no.shaw.ca ([64.59.134.9]) by SNT004-MC1F17.hotmail.com over TLS secured channel with Microsoft SMTPSVC(7.5.7601.23143);
Wed, 17 Aug 2016 01:53:46 -0700
Received: from WcTerm2008 ([50.64.43.38])
by shaw.ca with SMTP
id ZwbQbc2LTXHJlZwbYbuWIu; Wed, 17 Aug 2016 02:53:45 -0600
X-Authority-Analysis: v=2.2 cv=Ffh1/926 c=1 sm=1 tr=0
a=VguuGMGSiR4BpcItGReRXg==:117 a=VguuGMGSiR4BpcItGReRXg==:17
a=y4TnA3hOuTAA:10 a=9DvhAHx2yrWFMPxQWpQA:9 a=69EAbJreAAAA:8
a=6hp4kk1XXWhqrmXLHW0A:9 a=t-IPkPogAAAA:8 a=uyQIwvsNAAAA:8 a=hLPHPdTyAAAA:8
a=1o__TFa4kUk51VGhoeAA:9 a=HH0bpSHNVioNDKtO:21 a=Hy_ydZeKIyIF_eGX:21
a=aOipft00PpTc25yM:21 a=_W_S_7VecoQA:10 a=jh_e8VN9Jl4A:10 a=rv1qcCB5K9MA:10
a=JlwNWS_Myq4plbCuGd51:22 a=TwOW_m0CY6OjrxjWeTv9:22 a=8sV6SyOtJpDAVk1rrJsX:22
a=ctl6QshWy2YnITtCvEPC:22
From: Apple =?ISO-8859-1?Q?=99?= - AppStore <order5749@ecommerce.apple.com>
Subject: Invoice
To: xxxxxxxxxxxxxxxxxxx@hotmail.com
Content-Type: multipart/alternative; boundary="UEh4aslzu0BKVUNKT3CHIm7nmT=_khFcqW0"
MIME-Version: 1.0
Date: Wed, 17 Aug 2016 01:53:44 -0700
X-CMAE-Envelope: MS4wfFijWJndS4lAf4MmQNboO98rsARaDP5za6KeHg5ly7T1qHRdzylvRt+Cl7W7sCLku3OAC2r9m4AezpE1TGt9aysNK4pMt8GpKvuIjrwZ0nwuN7seRF8H
tx02593QI+3cirJa8W1EVnGIvbsTmQz27m3T7ke+NLnMzoKgx9cdd8Eb9AMUfkUnm/hEKi0jDlYMrA==
Return-Path: order5749@ecommerce.apple.com
Message-ID: <SNT004-MC1F17XyCTr9001b42d6@SNT004-MC1F17.hotmail.com>
X-OriginalArrivalTime: 17 Aug 2016 08:53:46.0532 (UTC) FILETIME=[DD65F640:01D1F864]

This is a multi-part message in MIME format

--UEh4aslzu0BKVUNKT3CHIm7nmT=_khFcqW0
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

- This mail is in HTML. Some elements may be ommited in plain text. -


Invoice
APPLE ID
xxxxxxxxxxxxxxxxxxx@hotmail.com
BILLED TO
xxxxxxxxxxxxxxxxxxx@hotmail.com
TOTAL
=A329.94
INVOICE DATE
16 Aug 2016
SEQUENCE NO.
1-85714114754
ORDER ID
MD98273482
DOCUMENT NO.
857741475924
App Store
TYPE
PURCHASED FROM
PRICE
Sing! Karaoke by Smule, VIP All Access Pass (Automatic Renewal)
Monthly | 31 Aug 2016
Report a Problem
In-App Purchase
=A329.94
Inclusive of VAT at

20%
VAT charged at 20%

=A31.66
TOTAL
=A329.94
To cancel your purchase within 7 days of receiving this invoice,
go to
Cancel and Manage Subscriptions
Learn more about your right of withdrawal

AndyPix

This is NOT a genuine email from Apple.


The senders IP address is assigned to shaw communications in Canada.
This ip address also appears on a lot of blacklists so it seems that one of their customers has a mail server that has an oppen relay that is being used by spammers to spoof email addresses.


Delete and ignore it - And obviously dont click any links within


Andy

andyroberts1234

I also received a similar email - seemed dodgy. Checked apple account and no apps purchased. Now sent to spam folder thanks to confirmation in this forum.

Mitzy06

Got the exact same email just now! I have an apple account but it's registered on a different email address to what this dodgy email was sent to. Also, I don't have this app. Just ignore it.

Malmo

I received one of these scam invoice emails in July.
The sender's IP address (http://whatismyipaddress.com/ip/68.114.190.27) is blacklisted on several anti-spam databases.