An Apple threat notification is a high-confidence warning that someone may have aimed mercenary spyware at you personally. It is far rarer than a normal security prompt, and it does not prove your iPhone was hacked.
The subject is back in the news because a fresh wave went out in late October. According to Apple’s notice, shared by security researcher Costin Raiu, this round reached users in 99 countries, and the Financial Times reports German lawmakers and officials began getting alerts on October 29. A frightening security message is also exactly what a scammer would copy, so your first job is confirming that Apple really sent it.
What an Apple threat notification actually means
Apple describes a very different threat from ordinary malware: expensive, short-lived attacks built to reach a handful of chosen people, often journalists, activists, politicians and diplomats. A single campaign can run into the millions of dollars, which is why Apple says almost nobody will ever see one of these warnings.
Apple has been sending them several times a year since 2021, and the running total now covers more than 150 countries. The company will not explain what set off your alert, because that could teach attackers how to dodge detection, and it never names a culprit or a region.
How Apple delivers the warning
According to the Apple support page on threat alerts, there are three official routes, and the mix can vary with your device and software version:
- On the iPhone. An alert shows up on the Lock Screen and inside Settings.
- By email. A message goes to the addresses tied to your Apple Account, sent from threat-notifications@email.apple.com.
- On the web. A banner sits at the top of your Apple Account page once you sign in at account.apple.com.
Notice what is missing from that list: text messages and phone calls.
3 checks for an Apple threat notification text scam
Many readers get an alarming message and cannot tell whether to believe it. Run these checks before you tap anything.
- Go to the source yourself. Open a browser, type account.apple.com by hand and sign in. A genuine alert will be obvious at the top of the page. No banner there means you should not trust the message.
- Read what it wants from you. Apple says these warnings will never push you toward a link, a file, an app or a profile. They also will not request your password or a verification code, whether by email or over the phone.
- Check how it arrived. A text or a surprise call does not match the routes above. A matching sender address on an email is a good sign, not proof, since sender names can be faked. The account page is the deciding test.
What to do after a real Apple threat notification
Update, then turn on Lockdown Mode. Install the latest software first. Then open Settings, tap Privacy & Security, scroll to Lockdown Mode, tap Turn On Lockdown Mode, confirm, and choose Turn On & Restart. You will need to repeat this on your iPad and Mac, while a paired Apple Watch follows the iPhone automatically.
Bring in experts. Apple strongly suggests contacting the Digital Security Helpline run by the nonprofit Access Now, which is reachable through its website around the clock. The helpline cannot tell you why the alert fired, though it can give advice tailored to your situation.
Treat the device with suspicion. Germany’s Federal Office for Information Security told recipients to assume their device may have been compromised. That is sensible caution. The agency has not said how the attacks worked, though this kind of spyware has used zero-click exploits that need no tap from the victim. Our guide on how to check an iPhone for spyware covers what you can and cannot find on your own.
What Lockdown Mode will change on your iPhone
Lockdown Mode is a deliberately blunt tool, so expect your phone to feel different right away.
| Area | What changes |
|---|---|
| Messages | Most attachments are blocked apart from certain photos, video and audio. Links and link previews stop working. |
| Web browsing | Some complex web technology is blocked, so certain sites load slowly or break. |
| FaceTime | Incoming FaceTime calls are blocked unless you called that person in the last 30 days. |
| Photos | Location is stripped when you share, and Shared Albums disappear from the app. |
| Connections | No automatic joining of non-secure Wi-Fi, and 2G and 3G are switched off. |
Regular phone calls, plain texts and SOS emergency calls keep working. On iOS 27 you can also lift messaging limits for one trusted person under Customize Contacts, but every exclusion weakens the protection, so use it sparingly.
Apple threat notification questions, answered
Does an Apple threat notification come as a text?
No text route is listed. Apple says it uses an alert on the iPhone, an email and a banner on your Apple Account page, so treat a text with suspicion and check your account page instead.
Is there a phone number for an Apple threat notification?
Apple lists no number on its support page for these alerts. It says the warnings never request your password or a code by phone, so hang up on anyone who claims otherwise.
Which countries get Apple threat notifications?
There is no fixed list. Apple says it has reached users in more than 150 countries since 2021, and it does not tie alerts to any region.
Can an Apple threat notification be wrong?
It is possible but Apple rates them as high confidence. The company admits its investigations can never reach absolute certainty, and it still says each alert should be taken very seriously.
Should you act on an Apple threat notification?
If the banner appears after you sign in at account.apple.com, act the same day: update, switch on Lockdown Mode and contact the helpline. If it does not appear, you are almost certainly looking at a scam, and the protections every iPhone already has by default are plenty for almost everyone. Trust the banner on Apple’s site, not the message in your pocket.
