Ask HN: Is this email from Apple legit?

When you are suspicious of any incoming emails, look for "received from" lines in SMTP envelope (not in the header fields which are trivially forgeable): as soon as email hits a normal server, it can't be forged anymore, and a relaying/delivering server will insert the actual header.

If there is no apple.com mail server in the sequence of received-from lines, it's not a valid email.

If there is, it should be valid or their MX servers are compromised.

Regardless, always browse yourself to wherever you need to update any banking info or personal data.

Erroneous send out by Apple according to https://www.macrumors.com/2022/07/28/apple-erroneously-sendi...

I think they must have sent a whole fuckton of these in error. I got it as well, it seems to be "legitimate" (in that I believe it is from Apple), but my account is not set up with iTunes Connect (and would have no reason to be, and trying to access it confirms this.)

Hello, some developers may have received an email yesterday noting that their banking information in iTunes Connect is invalid and needs to be corrected. This email was sent in error and we apologize. No action needs to be taken at this time.

source: https://developer.apple.com/forums/thread/711039

Turns out Apple has a help doc on identifying legitimate Apple emails:

https://support.apple.com/en-us/HT201679

In any case, avoid any links in the email. If you think it’s legitimate, update your payment information by following what’s listed in the above doc or by getting there through means outside of what’s provided in the email.

I got the same email just now and wondered the same thing. This post was the only result when I googled the first sentence. I also did have an Apple developer account, although I haven't used it for a few years. They certainly don't owe me any money. The email does have my real name in it, which is different from the "Dear customer" in normal phishing emails. There was a story on The Register yesterday about Apple's network being hijacked and routed through Russia so I'm wondering if these two things are connected.

Same here. Also have an Apple dev account. Make my living from app sales. Nearly got a heart attack. This is my only source of income.

Phishing bells went off immediately too, so I did not click. Looked at source code of email… urls go to itunespartner.apple.com and itunesconnect.apple.com so at least that part seems legit.

I’m away from my computer for a few days so can’t check smtp envelope. Anyone done this?

To me indeed looks like (and sincerely hope) a screw up on Apple side.

But since today is pay day I’ll be doing ‘pull-to-refresh’ in my banking app for the rest of the day :/

I received the same e-mail. My music is distributed to Apple through CD Baby so I have never received direct payment from Apple. I thought there might have been an error on the CD Baby side but wondered why the e-mail was sent to my address and name. As with digitsdashes, this post was the only result when I Googled. I will ignore the e-mail for now. Thanks for posting and commenting.

Update: I received a response from Apple now:

"You were sent an email today noting that your banking information in iTunes Connect is invalid and needs to be corrected. This email was sent in error and you do not need to update banking information. We apologize for the error."

I got it as well on two separate accounts. One of which I changed the banking information this month and Apple owes me money and one which doesn't have any banking information at all. Very weird.

Since today is payday on the first account I will let you know if the payment gets through regardless.

I got the same email like 40 minutes ago.

My friend and I have two separate developer account, with different bank account from the same bank and the same branch. I got the email but He didn't.

And I've been getting paid for the last 6 months with this very bank account without any problem.

It's weird for me too.

I did receive it as well.

The previous payments went through with no problem and I haven't made any changes since then.

Strange that the contact us redirects to a itunes account. When trying to login it says I don't have an account there.

I've got this email from Apple and it looks legitimate. The problem is there are no warnings on in app store connect - agreements,tax and banking and I received payment last month..

I am living from app sales too. Got heart attack. Received that email and after two hours successfully received payment.

Same here. Are you using a SEPA bank account? This might be the issue…. Idk I just emailed Apple for clarification.

Received that for 2 separated appstore accounts today. Must be sent in error.

Just got one of these too. I wish they were going to pay me money.

Can vouch for receiving the same emails in the last couple of days.