Hcfyk

I received an email with the subject "Your invoice from Apple #xxxxx".
It then continues by: "[...] your payment from "Pokemon Go was accepted [...]". That line made me sceptical. I just downloaded the app recently. How could the scammer know this? Was it just a good guess?



I assume it to be scam since:

• The sender is surpressed


• Typos


• No Username / data


• Generic text


• A suspicious little pdf


• Not the signature / style from your friendly, expensive fruit seller tech company

Some online warning sites already caught up on it

What I could think of:

• Another free app reports my other apps to the vendor


• A site I often visit has cookies that I was looking up stuff from let's go pikachu
  


• My account could actually be compromized and someone has access to my records


• Many people have the app installed
  
  
  If only a fraction of the people who have the app open the attached pdf the scammer wins.

Anyway, how could this be and what counter messurements can I apply?

It's a game of probability and chances are high that you might have one of the most popular apps in history installed on your device.

My guess is that the scammer does not know anything about you. The app in question is widely popular and one of the most successful apps on both iOS and Android. An attacker may just send out large amounts of mails containing such "most probable apps"/"best guesses". It would have been the same if the scammer sent an invoice for WhatsApp, which you most probably have installed on your device.

This tactic can also be observed in other recent spam waves like the notorious sextorion scam where the attacker sends a rather ominous remark about your porn preferences:

i installed a software on the adult videos (pornographic material) web-site [...] 1st part displays the video you were viewing (you’ve got a nice taste haha)

So to sum it up, this is most likely just a wild, but very probable guess, and you are not compromised. Countermeasures in this case: delete the email, go catch some Pokémon and have fun.

Pokemon Go is a very popular app. I would not be surprised if that email was being scatter-gunned to see who might panic and do what the phishing email wants. The other possibilities include:

• Niantic (the devs of Pokemon Go) has been compromised - not very likely


• The providers of another app on your phone have detected you use it and have sold that info onto someone else.


• The attackers know either you have a Pokemon Go or an Apple account - not necessarily both.


• You yourself provided that information somewhere


• Another one of your accounts, where you have used your email address and talked about Pokemon Go on iPhone, has been compromised

Former Apple Inc. employee here. I have seen some shady stuff on people's phones and what you're experiencing isn't new--I have received the same emails. That's how they phish people. They get receivers of the email to contact them, then try to dispute the charge, unknowingly giving over private information to help "resolve" the issue. If your account has been compromised, they can see your app purchases. Purchases include free downloads. Here's what I'd suggest to check:

1. Firstly, check the email address from the email. If it's non-Apple, dismiss it.


2. Check the devices associated with your phone. Settings>Your Name(top). There, if you scroll down, you should see a list of your Apple Devices. If you do not recognize one. You may have someone signed in to your account.


3. Check your "Family Sharing" tab. If you are a part of a family you shouldn't be, you may be compromised. (Settings>Your Name>Family Sharing)


4. Check to see if there is a "Profile" on your phone. This is popular with business phones to monitor employees, but some people use this maliciously. (Settings>General ... scroll and look for something that may not belong).


5. This one is tricky, make sure when you're connected to wifi, you're on a known secure network. Users often join networks to save their data, but I personally have known people to travel with a hotspot in populated areas to get people to connect to it. From there, they can find a way to mess with your device or information. Same goes with connecting to those free chargers in public spaces, like at airports -- be very wary.

Hope this helps someone

Answer void in light of updated info in question.

Sounds like a valid invoice for an in-app purchase. Invoice in this case just means receipt - not that you need make additional payment action. So just Apple notifying you its processing the payment and that the source was from (within) Pokemon Go.

But info for scammers is readily available. Its all part of the marketing frenzy that has been building since the mid-1990s. Lots of websites and businesses trade marketing data to help sell products. Lots bad security on those databases or legitimate sales with too few questions asked.

Read those OS and application EULAs. Getting marketing data about your interests to vendors who might sell similar or connected products is an intrinsic part of commercial OS and apps -- and even ISO standards. Cookies are just one avenue for direct query of your phone/computer. Almost 20 years ago I was surprised as a neophyte web administrator that Microsoft websites automatically harvested the default email address of every website user. A legitimate HTTP query from server which even compliant open source software must have the ability to honor (but can default responding to be off).

To be honest, I would not be surprised if most web browers cough up matching app info to the right webserver queries. Apple/iTunes is a LOT better about privacy from vendors than Android/PlayStore but not immune I bet. iTunes itself may let registered vendors indirectly send messages to app owners based on specified criteria...for a fee. I would expect Apple policy is to review such messages first but everyone has bad or rushed days. I do not know actual details though since I am not a registered vendor.

If there is no actual email header even to special email clients that can show invisible email header info...then you need to suspect that it did not arrive by email. No header is like letter without address, won't get delivered.

This can happen at the email server if server is running a bad app or otherwise got intrusion. If its Apple mail or other really big and professional provider, I would not expect this. But college email servers and other lower level or private providers might occasionally have issues.

* Its possible for another "bad" app on your phone to inject stuff into your email queue if you are not using webmail. * I would not expect this if all your apps are through Apple Store/iTunes.

But if you jail broke your iPhone to add any unapproved apps...
now is the time to re-evaluate them. Even if they appear to deliver the promised functions (game?/game hack), they may also do something else as well.