Matt Mullenweg, the co-founder of WordPress, almost got hooked by an Apple ID phishing scam in March. He wrote up the whole thing on his blog, and it’s a story everyone using an Apple ID should read.

This wasn’t a sloppy email with broken English asking him to confirm his account before midnight. The scam stacked four pieces of work that, taken together, looked almost identical to legitimate Apple security activity.

First, his Apple Watch, iPhone, and Mac all started buzzing at once with prompts to reset his Apple ID password. He hadn’t asked for any reset. Someone was bombing Apple’s real password reset flow against his account, hoping he’d tap “Allow” on one of the alerts out of confusion or fatigue.

Then the scammers called Apple Support themselves, pretending to be Matt. They claimed he’d lost his phone and needed to update the number on the account. Apple did what Apple does. They generated a real case ID. They sent legitimate emails from real Apple servers. Those messages landed in Matt’s inbox, properly signed, looking exactly like Apple emails should look.

A few minutes later, a text came through with a link to a site called audit-apple.com, asking him to review and cancel the pending request. The page was a pixel-perfect Apple replica. It displayed the real case ID from the actual Apple emails. It even showed a fake transcript of the scammer’s call to Apple, stitched in to make the page look like a transparent record of legitimate support activity.

Then a phone call from a calm, professional voice introducing himself as Alexander from Apple Support finished the play with a spoofed caller ID. He didn’t sound like a scammer. He sounded like Apple.

Matt caught it. He started poking at the phishing page and noticed that any case ID he typed in returned the same result. The site wasn’t validating anything. Once he saw the trick, he confronted the caller, who hung up.

Most people would not have caught it.

Matt Mullenweg runs a major tech company. He has Lockdown Mode turned on across his devices. He thinks about security all day. And he got close to clicking through.

The old phishing detection rules are showing their age. We were trained to look for typos, weird grammar, sketchy URLs, and broken logos. Those tells worked when scams were cheap and lazy. They don’t work anymore.

AI has changed the economics. Generating clean copy in any language costs nothing. Cloning a website is automated. Voice synthesis can put a convincing support agent on the line. An attacker can pull your background off LinkedIn and old blog posts in minutes. The friction that protected most of us has collapsed.

So the rules have to change with it. A few things I now do without exception:

• If someone calls claiming to be from Apple, my bank, or any service, I hang up and call the official number myself. Always. No matter how legitimate the caller sounds.
• If I get a password reset prompt I didn’t trigger, I don’t tap anything. I open the app or website directly and check the account from there.
• If a text or email asks me to click a link to “review” or “cancel” a request, I treat it as hostile until proven otherwise. I get to the service the long way around.
• I keep two-factor authentication on hardware keys for the accounts that matter most. A phishing site can’t replay a hardware key.

None of this is foolproof. Matt’s case shows what a well-resourced attacker can put together when they decide you’re worth the trouble. The defenses just have to be good enough to make the attacker move on to an easier target.

Constant vigilance.