"Your iCloud Storage Is Full": The Fake Apple Email Designed to Steal Your Card

You've probably seen it. An email drops into your inbox with a subject line like "Your iCloud account has reached its maximum storage capacity" or "Your payment method has expired, cloud service disabled." The Apple logo looks right. The colors look right. And somewhere in your gut, a small alarm fires: what if my photos really are about to disappear?

That feeling is exactly what scammers are counting on.

This phishing scam has been hitting inboxes at scale, and it's built specifically to steal your payment card details, not just your Apple password. Here's how it works, what the red flags look like, and what to do if you already clicked.

Why Apple is such a valuable target

Apple isn't chosen at random. According to Check Point Research’s Q3 2026 Brand Phishing Report, Apple was the second most impersonated brand in phishing attacks globally, accounting for 8% of attempts (tied with Google), behind Microsoft at 33%.

The logic is simple: Apple says more than 2.5 billion devices are actively in use, and iCloud+ and other Apple subscriptions mean many accounts have a payment card on file. And Apple’s design language is clean and minimal, which makes it easier to copy convincingly.

iCloud storage is a particularly effective hook because it's personal. Your photos, your contacts, your backups. The threat of losing those files triggers a real emotional response, and emotional responses tend to short-circuit careful thinking. Scammers know this, and they lean into it hard.

How the fake iCloud email scam actually works

The scam follows a clear playbook. Knowing the steps makes it much harder to fall for.

Step 1: The bait arrives.

You get an email claiming your iCloud storage is full, or that your payment has failed. Subject lines vary. The Guardian reported seeing versions like "We've blocked your account! Your photos and videos will be deleted on [date]," "Your payment method has expired! Your cloud service has been disabled," among others.

Scammers send these in bulk to large address lists. They don't know for certain you're an Apple user. They're betting you probably are, and that a percentage of recipients will panic and click without thinking.

Step 2: The pressure builds.

If you don't respond, a follow-up arrives. It's a "final warning" with a specific deletion date. Malwarebytes found that the deadline is almost always set just two days out, close enough to create panic, far enough to seem plausible. No scammer ever wants you to think things through before you act.

The date is invented. The urgency is manufactured. But it works.

Step 3: You click and land on a convincing fake.

The email contains a button prompting you to update your payment details, which takes you to a site built to look like Apple's. Fast Company notes that in some versions, clicking the link can trigger a malware download before you've entered a single character.

Step 4: Your card details are harvested.

The fake site asks you to sign in with your Apple ID, then prompts you to confirm a payment card to cover the storage upgrade. Malwarebytes makes an important point here: scammers don't actually care about the small charge they're asking for. What they want is for you to fill out the form. Your card number is the real prize, and it goes straight to them the moment you hit submit.

Step 5: The scam spreads.

If a scammer gets into your Apple ID, they could try to use your contacts to send the same phishing messages to people who trust you. A message from a known contact is far more convincing than a cold email from a stranger, which is how campaigns like this can spread.

How to spot a fake iCloud storage email

None of these emails are flawless. Most of them have tells.

• The sender address is off. Real Apple emails come from Apple domains such as @apple.com or @email.apple.com, and Apple’s phishing guidance lists a sender that doesn’t match as a red flag. Scam emails often use domains with extra characters, unrelated words, or regional codes. The Guardian found examples linked to Ecuador or containing ".biz.ua", a Ukrainian business domain.
• It greets you generically. “Dear Client” or “Dear User” instead of your name is a warning sign, though not proof on its own.
• The grammar is wrong. Scam emails often contain grammar errors such as incorrect verb conjugations. But AI tools now make polished scams common, so a clean email is not proof of a real one.
• It creates a fake deadline. A real storage notice won’t threaten to delete your photos or videos by a set date. Scam emails add a countdown to rush you into clicking.
• The link goes somewhere unexpected. Before clicking, hover over the link on desktop, or press and hold on mobile to preview the destination. If the domain isn’t one you recognize as Apple’s, don’t go further. Better still, skip the link and open Settings.
• It tells you to fix storage or billing through a link. iCloud+ plans renew automatically. If you’re worried about storage or billing, check Settings directly instead of using a link in an email. An email that tells you to click a link and enter card details to keep your storage is a scam signal on its own.

What to do if you already clicked

Clicking doesn't automatically mean the damage is done, but it does mean you need to move quickly.

1. Don't enter anything. If you haven't submitted your Apple ID or card details yet, close the page. You may still avoid any harm.
2. Change your Apple ID password now. Go directly to Settings > [your name] > Sign-In & Security > Change Password on your device, or to account.apple.com. Apple now calls it your Apple Account (formerly Apple ID), and Apple’s support page walks through changing the password. Don’t use any link from the suspicious email.
3. Check your Apple ID for unrecognized devices. Go to Settings, tap your name, and scroll through the device list. Remove anything you don't recognize.
4. Call your bank if you entered card details. Tell them you may have been phished. They can flag the account for fraudulent transactions or issue a new card.
5. Check that two-factor authentication is on. Apple turns it on by default for most accounts. With it, a password alone isn’t enough: signing in also needs a code from a trusted device or phone number.
6. Report the email. Forward it to reportphishing@apple.com, as Apple advises.

How to check your actual iCloud storage (without clicking a thing)

If you’re really unsure whether your storage is full, check it directly:

• On iPhone or iPad: Settings > [your name] > iCloud, then tap Storage or Manage Account Storage
• On Mac: Apple menu > System Settings > [your name] > iCloud, then Manage
• On the web: Type icloud.com directly into your browser, don't follow a link from an email

If you need more storage, Apple will let you upgrade from inside those same settings. No email required. Apple’s storage guide has the current steps.

Stay one step ahead

The combination of a trusted brand, an emotional trigger, and a polished fake site makes this type of scam effective. The good news is that the pattern is learnable. Once you know what a fake iCloud email is trying to do, it's much harder to fall for it.

The rule is simple: never click a link in an email to manage your Apple account or storage. Go directly to your settings. And if something feels off, trust that instinct before you type anything.

Conclusion

If an email says something is wrong with your iCloud storage or payment, treat the link as the trap, not the problem. Open Settings yourself, and if you’ve already clicked, move quickly: change your password and call your bank.

Guardio doesn’t manage your Apple Account or iCloud storage, but it covers a related risk. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and Email Security flags phishing emails that get past the Gmail spam filter. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.