If you’re called by an unidentified number, the advice is to remain silent until you’re sure there’s a human being on the line. Is this the end of an era?
Name: Hello.
Age: 200 years old.
Continue reading...
© Photograph: Posed by model Getty Images
© Photograph: Posed by model Getty Images
© Photograph: Posed by model Getty Images
Despite my history of uncovering App Store frauds, I rarely go looking for these things intentionally! They’re just so pervasive and obvious, they jump out at me. In this case, I was looking at the list of top paid Safari extensions in the Mac App Store, because two of my own extensions are currently on the list, when I noticed the TabControl Extension.
[…]
The Mac App Store “screenshot” for the app is not actually a screenshot at all. If you look closely, that’s not the real Safari: the toolbar elements are wrong. I suspect that the image was AI-generated.
[…]
Another thing you should note in the fake screenshot is the “4.9 out of 5” stars, giving the impression that this is the App Store user rating of the app.
[…]
These purported reviews, all but one of which is 5 stars, are all in English. Yet none of them is in the US App Store. […] If you’ve ever looked through App Store user reviews, it’s unusual to find this naming format. […] the dates on the reviews, such as “Mar 12,” predate the release of TabControl Extension in the App Store!
God only knows what this obvious AI slop scam is doing with the data from users’ Safari tabs. It’s currently the 12th or 13th most popular Safari extension in the App Store.
Coincidentally, on the same day well-known developer Marco Arment complained on social media that his new, unreleased Mac App Store app had been waiting 12 days for review by Apple.
Arment ended up waiting on hold—listening to an odd choice of music—to talk to App Review, which I didn’t realize was an option. His Unforgetful app is now approved.
Johnson continued browsing Safari extensions in the store:
The apps’s privacy policy is again on Google Drive, but the developer website link goes to
https://aee5e5015.app-ads-txt.com, a suspicious URL. This website is barren and simply redirects back to the App Store[…] Did App Store review ever bother to click the developer website link?[…]
In addition to the 41 apps, each of which required at least one submission to App Store review, I count across those 41 apps at least 327 updates, almost all of which have the same generic description for what’s new in the update: "Bug fixes and performance improvements." So that’s at least 368 submissions to App Store review, most within the past 12 months, from a single developer. In other words, the developer is averaging almost one submission per day. We can count only approved submissions; we have no idea how many submissions by the developer were privately rejected by App Store review.
I get the impression that Apple is asleep at the wheel. Is anyone at Apple counting submissions per developer? How many is too many? How many resources is one developer allowed to consume?
[…]
You may view it as a noble, democratic ideal to treat every app developer the same, but in reality this is the path to the crApp Store, full of scams and slop.
There’s no doubt that there is spam on the App Store, but the way to remove it is to target the spammers, not new developers, students, and hobbyists looking to build their ideas. I know that being an indie developer isn’t an easy way to make a living, but erecting barriers to submitting apps is the surest way to starve Apple platforms of fresh, innovative ideas.
I’d like to see App Store spam cleaned up as much as anyone, but the way to do it isn’t preferring well-known developers and those who can afford to pay more for special treatment.
I don’t agree with paid tiers either. However it feels like there should be a natural brake applied to new developers and new apps. It’s no big deal if your first app takes a week or two to review (often did 10y ago), and as it matures & receives meaningful updates in the store, turnaround increases as trust and “value” (active users?) builds up. Like “tarpitting” new accounts. I think limiting the # of new apps you can add per month to say 1 or 2 would also help…
I was a new App Store developer myself ten years ago. My previous article didn’t propose any new barriers for those groups. To be clear, I did imply that no developer, whether new or not, should have more than 40 apps and average a new App Store submission every day of the year. I’m not aware of any prominent developer who has that many. Apparently, checking just now, Microsoft by my count has 38 App Store apps between iOS and Mac, which is a lot but still less than the 41 apps of the developer I discussed in my previous article who is definitely not one of the largest software developers in the world along with Microsoft. I do think it’s reasonable for Microsoft to pay a significantly higher developer fee to have those 38 apps reviewed than a smaller developer pays to have one app reviewed by Apple.
[…]
My contention is that Apple is actually wasting its own resources treating every developer like a potential spammer or scammer, even the developers who are known to be trustworthy, and this wasting of resources makes it harder on everyone, including new developers, students, and hobbyists. App review is grossly inefficient, and it’s clearly failing to scale to the increase in App Store submissions. What I propose is not raising the gates but rather lowering the gates for developers who have already proven trustworthy, so that Apple can focus its review efforts where they’re most needed.
I’m not sure that paying more would help anything. If scams are profitable, surely it would be worth them paying more, and then we’re back to square one. And I don’t want to create another situation like App Store Search Ads where providing poor service makes the revenue numbers go up. But I like the general idea of considering the account’s history, e.g. the way the Discourse forum gradually increases trust over time. It should count for something if you have a long history of following the rules and submitting updates to a small number of apps on a reasonable schedule vs. frequent spamming of submissions that don’t even have real release notes. It would not be fair for Microsoft to be able to cut in line, but giving spammers equal access to the review queue means they’ll use more than their share of Apple’s resources. That also seems unfair. The current system encourages frequent submissions, which also increases the overall load on the reviewers. I think the incentives need to be changed somehow. Maybe each account should get a certain number of “fast” submissions per month or year, after which you can still submit but it goes into a lower priority queue.
Even among more legitimate-seeming apps, though, Apple is ignoring clear problems. In AppleInsider research, for instance, we found that many price tiers listed for the “Simply Piano” app bore no relation to what the developer actually charges.
[…]
You shouldn’t have to be the one to investigate apps you want to try. That is the future of third-party App Stores, and that is a future to be fought.
But that future is here with the first-party App Store we already have. And this inability to trust an App Store is here, right now, because Apple will not do what it keeps saying it is doing and what it is charging developers to do.
Previously:
Update (2026-08-20): Eric deRuiter:
I wonder if there is already a separate queue, not for Marco or other established indies, but for the huge companies: Facebook, Spotify, Google, etc.
Apparently the App Store developer in question saw my article in the news, because the fake App Store reviews posted on the developer’s website were quickly removed, as reported by AppleInsider and confirmed by me. Until yesterday, the misleading “4.9 out of 5 stars” claim remained in the App Store. However, the developer released an update only hours ago with new screenshots that no longer include the misleading claim, thereby erasing all evidence of the previous fraud. Apple approved the developer’s update and, needless to say, did not remove the app from the App Store.
[…]
There are 59 reviews [of Authenticator ℠], 54 of which are 1 star, and 3 of which are 2 stars. Two of the reviews are 5 stars; of those, one is titled “space jam” and goes on to say, “i believe i can fly and touch the sky.” Anyway, the question is, how did the app manage ratings of 4.1 out of 5 when the reviews average 1.2 out of 5? (That’s a rhetorical question. I think we all know the answer.)
A Washington, D.C., resident recently received a startling text message that claimed Apple Pay had already charged him $8,250, with a second identical charge set to go through automatically in only 35 minutes, Fox News’ CyberGuy Kurt Knutsson reports. The message, which appeared to come from “Apple Pay Account Services,” instructed him to call a toll-free number immediately, reference a case ID, and “verbally kill” the pending transaction—or risk losing the money forever.
The recipient, identified as Paul C., wisely paused instead of dialing. He forwarded the message for review rather than engaging. The text is a classic example of a high-pressure callback scam designed to create panic and push people into contacting criminals posing as support agents.
Key Red Flags in the Message
Several details immediately signal fraud:
• The text arrived from a +44 number (United Kingdom country code), yet directed a U.S. recipient to an unrelated 855 callback line.
• Dramatic, unprofessional language such as the account having “hemorrhaged” money, a “catastrophic fraud event,” a contactless limit “crushed” to $0, and the need to “verbally kill” a charge. Legitimate financial alerts use clear, straightforward wording.
• Vague and nonsensical merchant descriptions, including an “agricultural processing surplus in Stockton, CA” and a “payday lending chain in Modesto.”
• Internal contradictions: the message claimed the contactless limit was already blocked at $0 while simultaneously warning that another large contactless charge would auto-approve shortly.
• Every instruction funneled the recipient toward calling the provided number. It never suggested checking the Wallet app, the bank’s official app, or the phone number printed on the physical card.
The 35-minute countdown is intentional. It creates just enough urgency to discourage careful verification while still giving the target time to place the call.
How the Scam Typically Unfolds
The text is only the bait. Once someone calls, the person on the other end may claim to see the account activity, request personal details, card numbers, Apple Account information, or one-time verification codes. In some cases, scammers push victims to install remote-access software so they can view the screen or guide transactions. Other variations involve claims of an oversized refund that must be “returned,” or instructions to move money into a supposedly safe account.
Similar Apple Pay-themed texts have previously put victims at risk of losses in the five-figure range.
How to Verify a Suspicious Charge Safely
Never call a number that appears in an unexpected text. Instead:
Check the full history in your bank or card issuer’s official app.
If anything looks wrong, call the customer-service number printed on the back of your physical card.
Apple has noted that Wallet does not always show complete transaction history for every card, so the bank remains the most reliable source.
Reporting and Next Steps
If you receive a similar message:
• Take a screenshot that includes the sender details.
• Report it as spam/junk in the Messages app, then block and delete the conversation.
• Forward the text to 7726 (SPAM).
• Email the screenshot to reportphishing@apple.com.
• File a report at ReportFraud.ftc.gov.
If you already called the number or shared information, hang up immediately. Contact your bank or card issuer through official channels to secure the account. Change any passwords that may have been compromised, enable or confirm two-factor authentication, and remove any remote-access software that was installed. Place credit freezes if sensitive personal data was shared.
Simple Habits That Reduce Risk
Slow down when any message imposes a tight deadline. Verify activity only through channels you already trust. Never read verification codes aloud or grant remote access to someone who contacts you first. Keep security software updated, limit the personal data available on people-search sites, and consider identity-monitoring tools if you have been targeted repeatedly.
MacDailyNews Take: This particular scam relies on fear and urgency rather than sophisticated technology. The best defense remains the same: pause, ignore the callback number, and check your accounts yourself through official apps or the number on your card.
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!
Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.
[Thanks to MacDailyNews Reader “Fred Mertz” for the heads up.]
The post Apple Pay text scam warns of $8,250 charge – and another one in just 35 minutes appeared first on MacDailyNews.
Successful scammers craft their campaigns using personal information found online. I used Incogni to purge that data for an elderly relative.
(via Cult of Mac - Your source for the latest Apple news, rumors, analysis, reviews, how-tos and deals.)
The notion that scammers can use AI to sharpen their deceptions, polish their language, and lubricate their banter with victims is now a reality for anyone fighting the fraud operations that steal tens of billions of dollars a year worldwide. But can AI fully replace a human scammer, autonomously building the web of deception leading up to the fake investment that defrauds the mark? One study's experiment suggests that it can—and may even be able to carry out the majority of that long con more effectively than humans.
Researchers from four universities—Amrita Vishwa Vidyapeetham in India, Foscari University of Venice, the University of Melbourne, and Ben Gurion University of the Negev—carried out a broad study on the use and potential of generative AI chatbots in the growing scam industry centered around a form of fraud known as “pig butchering,” text-based romance scams that eventually shift to fake crypto investments that steal as much as six-figure sums from victims. In their study, the researchers pitted AI chatbots directly against humans in a simulation of the scamming process—or more specifically, the long, trust-building conversations that eventually lead up to soliciting a fake investment from the scam’s target.
They found that for the relationship-establishing stages of the scam—the stage that in real-world scams typically represents the longest part of the interactions with the victim, often stretching to months—an AI chatbot performed remarkably effectively, successfully impersonating a human and by some measures outperforming the real human “scammers” in their experiment.
© Nansan Houn/Getty
Last April, Brazilian officials notified Apple and Google over an alleged lack of age controls in betting apps on their respective app stores.
Brazilian users browsing the App Store rankings in categories such as Navigation, Travel, and Weather have noticed a growing number of poorly made games appearing among the top results, many of them featuring AI-generated illustrations of animals as their app icons. Many carry an AL age rating, making them available to users of all ages, including children.
As it turns out, these are so-called jacket apps, which are just a front for hidden betting and gambling apps.
[…]
The repository also includes explicit instructions intended to prevent the apps from being flagged as suspicious during App Store review. These include giving each app uniquely named startup and remote-configuration codes, making it harder for reviewers to identify them as part of the same group.
Ironically, the App Store’s own recommendation system appears to have little trouble grouping the apps together, as the “You Might Also Like” section on several of these apps points users toward other suspicious apps more frequently than they point to genuine apps.
Obviously the main problem is that these apps disguise themselves Trojan Horse-style, and slip through App Store review undetected. I don’t think it’s reasonable to think App Store review could catch every attempt at this sort of thing though — if the horses are disguised well-enough, some of them are going to slip through. That’s actually fine.
I agree that it’s unreasonable to expect App Review to catch all those, but then Apple should not be pretending that it can. This was all obvious from day one. The public perception of App Review is completely at odds with what it actually can and does do.
But the first example 9to5Mac cites isn’t well disguised at all. What sense does it make that “PotatoPlot Puzzle” — a game featuring a rabbit potato farmer — is a weather app? How is that not a red flag right there?
[…]
I always mention that the point of such a squad shouldn’t be to make the App Store 100 percent scammer-free — which I believe is an impossible goal that would set the team up for failure. The point should be only to make the App Store free of successful scams. Focus on the most popular apps and the most lucrative apps.
The App Store is more than 18 years old. The idea of patrolling the top charts probably occurred to Apple before it even shipped. They just don’t want to do it.
Apple only took 24 hours to approve my iOS app update that crashed instantly on launch. Such a blessing to have that extra level of reliability and security that only a manual review process can provide 🙏
Incidentally, the crash was due to a missing dylib - something that could easily have been detected by the automated scan process, if only that scan were designed to protect users’ and developers’ interests instead of Apple’s.
There is simply no other way to maintain a modern, healthy software ecosystem without making sure that apps that have been around for 7 years and 20 major versions can’t get a build looked at within 48 hours. There’s no other way. Probably needs to be longer, honestly.
I had to file an Expedited Review Request because this update is a legitimate emergency. Four hours later, App Review rejected the build because they didn’t follow the first sentence of the testing instructions (which haven’t changed in 7 years). Back to Waiting for Review! There’s no other way.
Previously:
Update (2026-07-30): Kyle Hughes:
We got rejected in the Expedited Review again, this time for not having an account deletion feature. Except we do, and it’s one button press away from the screen that the reviewer was on. And it has always existed. Is this how the expedited review works? Malicious incompetence?
Update (2026-07-31): Kyle Hughes:
If you were wondering how long one of the “you can ask us to approve this build and can fix this issue in the next release” App Review errors takes to resolve when you’re in the Expedited Review Queue… me too! So far, 18 hours. (Ignoring the fact that we have the feature the rejection was for.)
Certainly it means “within a week,” right? “Within a month,” please? “In your lifetime,” I can only hope.
Joe Rossignol (PDF):
The complaint alleges that Apple violated California’s Consumers Legal Remedies Act and other laws by failing to adequately review and monitor apps distributed through the App Store, despite marketing it as “a safe and trusted place to discover and download apps.” Due to these assurances in Apple’s marketing, the complaint said the plaintiffs trusted that a Sparrow Wallet app they downloaded from the App Store on iOS was legitimate, when in reality it was a fraudulent spoof designed to steal Bitcoin from users.
Sparrow Wallet is only available on Windows, macOS, and Linux. The popular Bitcoin wallet is not available on iOS, but scammers have released fake lookalike apps in the App Store that can trick users into giving up control of their funds.
[…]
Even when victims reported fraud, the lawsuit alleges that Apple often took little to no action, and it says other fake Sparrow apps remain in the App Store.
Sparrow Wallet developer Craig Raw has publicly addressed Apple’s slow response to multiple fake versions of his app appearing in the App Store. In a January 2024 social media post, for example, he said “there is still a scam ‘Sparrow Wallet’ app on the @Apple App Store, despite myself and others having reported it weeks ago.”
My attempt to protect users from scam apps on the @AppStore has gotten my Apple Developer account flagged for termination - ironically, for “dishonest activity”.
[…]
I’m the developer of the real Sparrow Wallet, a desktop app, and I hold the registered US trademarks for the name and logo. I have publicly warned @Apple and the community about these fake apps from early 2024, but they keep appearing.
The app @Apple flagged was a placeholder that was never published. Its only purpose was to warn users that Sparrow is desktop-only and that other “Sparrow” apps aren’t mine. This approach may have been misguided, but there was nothing dishonest about it.
In response to our request for comment, Apple said it has taken swift action to remove any apps impersonating Sparrow Wallet[…] Apple says it takes immediate action against apps that do not comply with its guidelines.
Previously:
Update (2026-07-28): Sarah Perez:
The complaint targets one of Apple’s longtime competitive arguments: that its tight control over its App Store makes its platform safer than those offered by its rivals. The company has used this claim to push back against deregulation of the app ecosystem, including third-party app stores and sideloading.
“As part of a sustained marketing campaign, Apple has positioned itself, its products and services, as offering a level of security and trustworthiness superior to any competing technology company,” the new filing states. “This includes assurances about the safety of applications distributed through its App Store. By retaining exclusive control over which apps are permitted on Apple devices, Apple has structured its platform to ensure that consumers depend entirely on its promise of safety and reliability,” it reads.
With third-party app stores, there would be an incentive to do better vetting than Apple, and with sideloading it would be clear that the app was not being downloaded from sparrowwallet.com.
Update (2026-07-29): Jeff Johnson:
What struck me about Apple’s response is that it places the burden of curating the App Store on developers and users rather than taking responsibility for it. After all, Apple reviews every version of every app before it can be published to the App Store. If Apple is curating the App Store, then why do scams have to be reported and removed? One wonders how the scams get past Apple review in the first place, and even if Apple review “is not perfect” (a gross euphemism), how the second line of defense, Apple employees patrolling the App Store for scams that the review team missed, also fails. The burden of App Store curation should not fall to me, a lone indie developer.
Apple’s response also ignores that the indie developer did report the scams, multiple times.
Previously:
International authorities and a raft of private technology companies say they have disrupted a cybercrime “assembly line” that allowed crooks to collect millions of login credentials and steal more than $47 million in ransom payments and by other fraudulent means.
The crux of the operation was the simultaneous targeting of two unrelated tools that are widely used in various online scams. The first is Amadey, a malware-as-a-service platform for compromising devices and delivering malicious payloads for ransomware and other scams. Amadey has been observed in the wild since at least 2018 and was seen last year abusing GitHub as it collected system information from infected devices and installed customized payloads. The second tool was StealC, an infostealer-as-a-service platform that collects credentials, authentication cookies, cryptocurrency wallets, browser extensions, and files whose names match customer-defined patterns.
Amadey and StealC are separate tools that are run independently of each other. Given their widespread use, however, many customers use both in their individual cybercrime activities. The tools also, it turns out, relied on some of the same underlying infrastructure to run. Microsoft said it made this determination after analyzing the tools using AI. This insight allowed Microsoft attorneys to seek an order disrupting both at the same time.
© Alex Schmidt / Getty Images
Login