A new phishing scam is raising concerns after reports showed that Apple Mail can label suspicious emails as coming from a “trusted sender,” potentially misleading users into letting their guard down.
According to Fox News, the issue came to light when a reader shared a screenshot of a questionable email that carried the reassuring message: “This message was sent from a trusted sender.” At first glance, the label makes the email appear safe, even though the content itself shows clear signs of fraud.
The catch is that the label does not confirm legitimacy. Instead, it’s generated by Apple Mail based on familiarity rather than security verification.
Apple Mail applies the trusted sender banner when it detects that an email address has some prior connection to the user. This could include being saved in contacts, appearing in earlier conversations, or having been replied to previously.
The feature is meant to help users quickly recognize known contacts. But as Fox News explainsit is not a security tool. It does not verify whether the sender is genuine or whether the message has been tampered with.
That gap is what scammers are now exploiting.
A familiar trick with a new twist
Phishing emails have long relied on impersonating trusted brands, but this tactic adds another layer of deception by leveraging the email app itself.
Cybercriminals can spoof email addresses to make messages appear to come from known or previously contacted sources. If Apple Mail recognizes that address, it may still assign the trusted sender label, even when the email is malicious. This creates what Fox News describes as “a false sense of safety,” in which users trust the interface rather than carefully reviewing the message.
Despite the convincing label, the phishing email highlighted in the report contained several classic red flags.
It used a generic greeting, such as “Dear user,” instead of addressing the recipient personally. It also referenced a service called “Cloud+ subscription,” which is slightly off from Apple’s real “iCloud+” branding. The message sought to create panic by warning that personal data could be deleted due to a payment issue, a common tactic used to rush victims into clicking links.
As Fox News notes, scammers often rely on urgency so “the victim clicks before thinking.”
The incident highlights a growing challenge in cybersecurity: attackers are no longer just mimicking companies; they are learning how to manipulate the systems people rely on to judge trust. When a built-in feature like a trusted sender label appears to validate an email, it can override a user’s instinct to question suspicious content.
Staying safe
Security experts stress that users should not rely solely on visual cues within email apps. Instead, they should verify account-related messages independently, such as by visiting official websites directly rather than clicking embedded links.
Other protective steps include enabling two-factor authentication, manually reviewing account settings, and monitoring for subtle branding errors or unusual wording.
Related reading: For more on emerging mobile threats, check out how the DarkSword exploit is exposing a dangerous iPhone vulnerability.