The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Apple email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Apple email shows a purchase you never made, then says your account is locked.
Apple’s page on App Store and iTunes Store emails says some phishing emails ask you to click a link to update your account information, and others look like a receipt for a purchase that you are certain you did not make. The email below is invented, and each number is one of the signs.
Example
Hello customer,
We noticed a purchase of $129.99 on a new device: Premium Cloud Storage, 12 months.
For your security, your Apple Account is locked. Confirm your details within 24 hours to unlock it.
You will need your password, your card number and the code sent to your phone.
The button says account.apple.com
The sender's address is not at apple.com.
The name says Apple, but the part after the @ belongs to someone else. Apple says a sign of phishing is a sender that doesn't match the name of the company it claims to be from.
A receipt for a purchase you never made, with no billing address.
Apple says genuine purchase receipts include your current billing address, which scammers are unlikely to have. This one has none.
A locked account and a deadline.
Apple says that if you're suspicious about an unexpected message, it's safer to presume it's a scam and to contact the company directly if you need to.
A request for your password, card number and a code.
Apple says it will never ask you to provide your password, device passcode or two-factor authentication code, or to enter it into any website.
A button that says account.apple.com and goes somewhere else.
Apple says a link that looks right but has a URL that doesn't match the company's website is a sign of phishing.
From Apple Support: Identify legitimate emails from the App Store or iTunes Store, read 7 November 2026.
From Apple Support: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams, read 7 November 2026.
From Gmail Help: Avoid & report phishing emails, read 7 November 2026.
Read the address from the right, because the last two parts say who owns it.
Anyone can put “Apple” in front of an address. The part to read is the domain, the web name after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Apple’s page says to change the password for your Apple Account in Settings on your device or at account.apple.com, and the owner of that address is apple.com.
Read the domain from the right
account.apple.com
From AppleOwned by apple.com. Apple's page names account.apple.com for changing your Apple Account password.
account.apple.com.unlock-now.example
Not from AppleOwned by unlock-now.example. account.apple.com is only a label in front of it.
appleid-support-desk.example
Not from AppleOwned by appleid-support-desk.example. The name has Apple in it, but the owner is someone else.
From Apple Support: Identify legitimate emails from the App Store or iTunes Store, read 7 November 2026.
A receipt is checked against your own purchase history, not against the email.
Apple gives two ways to check an email about a purchase: look for your current billing address on the receipt, and review your purchase history. If a receipt shows a purchase your history does not, the email is not telling you the truth.
The check
- The email says
You bought Premium Cloud Storage for $129.99.
Nothing in the email proves it, and it shows no billing address.
- You check it yourself
Your billing address on the receipt, and your purchase history.
Apple says genuine receipts include your current billing address, and that you can review your purchase history.
- Neither shows it
Then the email is fake.
Apple says scammers are unlikely to have your billing address.
From Apple Support: Identify legitimate emails from the App Store or iTunes Store, read 7 November 2026.
Apple lists what it will never ask you for, and a fake email asks for it anyway.
Apple’s pages name specific things it will never ask for in an email or on a website.
| Question | What Apple says | What a fake Apple email does |
|---|---|---|
| Does it ask for a password or a code? | What Apple saysApple will never ask you to log in to any website, or to provide your password, device passcode or two-factor authentication code, or to enter it into any website. | What a fake Apple email doesIt tells you to enter your password and a code on the page its button opens. |
| Does it ask for a card number? | What Apple saysApple says emails about App Store, iTunes Store or Apple Music purchases will never ask for a Social Security Number, mother's maiden name, full credit card number or card CCV code. | What a fake Apple email doesIt asks for a card number to confirm that you are the owner. |
| Does it ask you to lower your protection? | What Apple saysApple will never ask you to disable any security feature on your device or on your account. | What a fake Apple email doesA story that you must turn off protection to get back in. |
| How does it want to be paid? | What Apple saysApple says never to use Apple Gift Cards to make payments to other people. | What a fake Apple email doesGift cards, from a caller or in a follow-up message. |
From Apple Support: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams, read 7 November 2026.
From Apple Support: Identify legitimate emails from the App Store or iTunes Store, read 7 November 2026.
Five steps tell you whether an Apple email is real without clicking anything.
- Leave the button and every link alone. Apple says never to enter your account information on websites linked from these messages, and never to download or open attachments in them.
- Look for your current billing address on the receipt, and check your purchase history, as in the picture above.
- Change account or payment details only in Settings on your own device, or in the App Store or iTunes. Apple says to update your Apple Account password only in Settings or at
account.apple.com. - Paste the email into the checker at the top of this page for a second read.
- Forward the email to
reportphishing@apple.com, then delete it. On a Mac, Apple says to choose Forward As Attachment from the Message menu, and for a text to email a screenshot to the same address. In Gmail you can also choose More next to Reply, then Report phishing.
From Apple Support: Identify legitimate emails from the App Store or iTunes Store, read 7 November 2026.
From Apple Support: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams, read 7 November 2026.
If you entered your password, Apple says to change it at once and turn on two-factor authentication.
Apple says that if you believe your Apple Account has been compromised, or you might have entered your password or other personal information on a scam website, you should change your Apple Account password immediately and make sure two-factor authentication is enabled. If someone phones and says they are Apple Support, Apple says to hang up, because scammers use fake Caller ID to spoof the numbers of companies like Apple.
What to do depends on what you did
You only read it.
Forward it to reportphishing@apple.com and delete it.
You clicked the link.
Enter nothing on the page that opened, and do not download or open anything from it.
You entered your password or card details.
Change your Apple Account password immediately and make sure two-factor authentication is on. Then follow the steps at IdentityTheft.gov for what you shared.
From Apple Support: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
The same checks work on other account and subscription emails.
A locked-account email can borrow any big name. The guide to fake Microsoft sign-in emails covers an account alert, and the guide to fake Netflix payment emails covers a failed payment. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell if an Apple receipt email is real?
Apple says genuine purchase receipts include your current billing address, which scammers are unlikely to have. It also says you can review your App Store, iTunes Store, iBooks Store or Apple Music purchase history to check a purchase.
What does Apple say it never asks for by email?
Apple says emails about your purchases will never ask you to provide your Social Security Number, mother's maiden name, full credit card number or credit card CCV code. It also says it will never ask you to log in to any website, or to provide your password, device passcode or two-factor authentication code or enter it into any website.
How do I update my Apple payment details safely?
Apple says that if an email asks you to update your account or payment information, only do so in Settings directly on your iPhone, iPad or iPod touch, in iTunes or the App Store on your Mac, or in iTunes on a PC. It says to update your Apple Account password only in Settings on your device or at account.apple.com.
Where do I report a fake Apple email?
Apple says to forward a suspicious email that looks like it is from Apple to reportphishing@apple.com. On a Mac, select the email and choose Forward As Attachment from the Message menu. For a text message, take a screenshot and email it to the same address.
What should I do if someone phones and says they are Apple Support?
Apple says that if you get an unsolicited or suspicious phone call from someone claiming to be from Apple or Apple Support, you should just hang up. It says scammers use fake Caller ID information to spoof the phone numbers of companies like Apple, and that you can report scam calls to the FTC at reportfraud.ftc.gov.
What if I entered my password on a fake page?
Apple says to change your Apple Account password immediately and make sure two-factor authentication is enabled. If you entered card or other personal details, IdentityTheft.gov lists the steps that match what you lost.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- Apple Support: Identify legitimate emails from the App Store or iTunes Store
- Apple Support: Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails