Fake iCloud Storage Full Alert Scam
Phishing emails and push notifications mimicking Apple warn victims that their iCloud storage is nearly full, steering them to fake upgrade pages that steal payment details or Apple ID credentials.
Part of: Cloud Storage Full Phishing Scams
Last reviewed: 8 June 2026
Apple notifies genuine iCloud users about storage limits through Settings > [Your Name] > iCloud on-device and occasionally via email from apple.com addresses. Paid upgrades are handled entirely within the Settings app or at icloud.com — Apple never directs users to third-party payment pages.
Criminals leverage the fact that many iPhone and Mac users regularly see legitimate 'iCloud Storage Almost Full' prompts and are primed to click upgrade links. A well-timed phishing email or browser notification mimicking this familiar alert can catch users off guard.
The fake alert redirects victims to a convincing iCloud billing page where entering a payment card number and Apple ID results in both credential theft and unauthorised card charges.
How this scam works on the Apple brand
The victim receives an email with a subject line such as 'Your iCloud storage is 97% full — upgrade now to avoid losing photos' sent from a spoofed or lookalike address such as [email protected]. The email design mirrors Apple's clean aesthetic with the Apple logo and a blue 'Upgrade Storage' button.
Clicking the button opens a page that mimics icloud.com with an Apple ID sign-in prompt. After the victim enters their credentials, they are shown a fake billing page asking for a credit card number to activate a storage plan. In reality, the Apple ID credentials are captured immediately and the card is charged or sold to card-fraud networks.
Some variants arrive as browser push notifications or even SMS, directing users to a short-URL that redirects through several hops before landing on the fraudulent page.
Common red flags
- The sender's domain is not @apple.com or @icloud.com — hover over the From address before clicking.
- The email links to a domain containing words like 'icloud-alert', 'apple-storage', or 'icloudupgrade' rather than icloud.com.
- You are asked to enter a credit card number on a webpage rather than managing storage inside your iPhone Settings app.
- The page requests your full Apple ID password rather than using Face ID or Touch ID as the real flow does.
- Urgent countdown timers or threats that photos will be deleted within 24 hours.
- The padlock or certificate in the browser address bar shows an unknown issuer or a generic domain.
How to protect yourself
- Always upgrade iCloud storage through Settings > [Your Name] > iCloud > Manage Storage on your device, not via email links.
- Check your real storage status at icloud.com after signing in directly — never via an email link.
- Enable two-factor authentication on your Apple ID so that stolen passwords alone cannot unlock your account.
- Use Sign in with Apple where possible to limit third-party credential exposure.
- If you entered card details, contact your bank immediately to dispute charges and request a new card.
How to report it
- Forward the phishing email to [email protected] as an attachment.
- Report the fraudulent website to the Anti-Phishing Working Group at [email protected].
- UK users can forward scam texts to 7726 (free) and report to Action Fraud at actionfraud.police.uk.
- US users can report to the FTC at ReportFraud.ftc.gov.
Frequently asked questions
Will Apple delete my photos if my iCloud storage is full?
Apple stops syncing new content when storage is full but does not delete existing photos. You have time to act through official channels without panic-clicking an email link.
How do I safely upgrade iCloud storage?
On iPhone: Settings > tap your name > iCloud > Manage Account Storage > Change Storage Plan. On Mac: System Settings > Apple ID > iCloud. Never follow email links to upgrade.
I entered my card details on a fake site — what now?
Call your bank or card issuer immediately to block the card and dispute any unauthorised charges. Then change your Apple ID password at appleid.apple.com and review your account for unrecognised devices.