How a Stranger Used One Text Message to Steal My Entire Digital Life -- Time
https://time.com/article/2026/07/07/how-a-stranger-used-one-text-message-to-steal-my-entire-digital-life/by Ryan Pettit
Ryan Pettit is a Hawai'i-based commercial airline pilot with a background in information technology.
For most of us, the honest answer is one. One account sits beneath the others: an Apple ID, a Google login, a phone number that every "forgot password" link routes back to. We would never accept this design anywhere else.
I'm a pilot. No aircraft I have ever flown is permitted a single point of failure: every critical system carries a backup, and often a backup for the backup, so that no single fault can bring the plane down. Redundancy is the first principle of any system that cannot be allowed to fail. And yet millions of people carry their entire financial and personal identity on exactly one such lock, and think nothing of it.
On the afternoon of June 25, 2026, I learned what happens when the lock turns in a stranger's hand. It began, as these things now do, with a text message. It looked entirely official: a fraud alert about a possible unauthorized charge on my Goldman Sachs Apple Card, the credit card tied to my Apple ID. The message asked only that I reply "yes" or "no" to confirm the transaction. This is a routine, familiar request, the kind your bank sends all the time. I replied no.
A few minutes later, my phone rang. The number, the FBI would later confirm, belonged to the genuine Apple Card support line. It had been spoofed so precisely that the messages accompanying the call arrived in the same gray bubbles, with the same Apple logo, that only real Apple support uses in iMessage. Everything my eyes could check told me this was Apple. The man on the line said he was going to send a code to verify my identity, and that I should read it back to him. It is a request that feels routine in the moment, though I now know that no legitimate institution should ever make it.
. . .
= new reply since forum marked as read
And it works? 
Very interesting, especially considering all the urgent messages over the years warning people to update their operating systems by a certain date because updates would not longer be available. 
No call back to the number that left the message. No response to a text. I just call the fraud line directly during their operating hours and they take care of it from there.
It seems with all the seamlessness of one google sign in or Apple ID, both have created a single point of failure. Get that info, which apparently isn't hard to do, and they've got the keys to the literal kingdom. My credit union short circuits all that. Plus asks me about 50 questions my better half doesn't even know all the answers to. 
"confirming that whoever is calling has reached a person who is connected to a specific active credit card at a specific phone number helps them build a financial profile connected to you"
In the specific case I described (which is by far the most common instance in which I receive fraud alerts regarding accounts I know are actually mine), the (possible) fraudsters are calling/texting you regarding a credit card purchase you know you actually attempted to make. Which means they *already know* that the phone number and credit card are linked. Therefore, somebody replying 'yes, I attempted to make this purchase' doesn't tell them anything more than what they already know, except that, at least at times, someone or something will reply from this particular phone number. It does not establish that they've reached a person who is connected to the card.
I guess what I'm saying is I absolutely get the logic of not responding to fraud alerts where you know you did NOT make/attempt to make a purchase (obviously especially true when you don't even have such an account). But if you are trying to make a purchase, the merchant says it was declined, and 10 seconds later you get a text that seems to be from your bank saying "did you attempt to make this purchase" and it's the correct card, amount and place you are at, I cannot grok the risk in replying "yes", in order to allow your purchase to go through, and avoid the hassle of your card being shut off.
Though I concede I may be inclined to justify taking an action that I myself do on the regular
The one thing that IS secure is that sort of stuff, these hackers can't override credit card terminals. Also, you've switched to talking phone calls, I'm talking about the specific case of texting back 'yes I am making this purchase' when my bank texts and I know the card was just declined. This is really not a fakeable scenario that I'm able to see. You're right there a LOT that are, esp. when it's out of the blue and/or it's not even a real account of yours. This is one case that's really not, as best I can tell.
But of course as you say, some may prefer to not chance it and don't mind restarting a card. Nothing wrong with that 
that's when your card gets suspended in a way that causes them to disallow all further activity on the card. If you say 'yes I did' then the merchant tries the card again and it will work, and the card is then not further suspended.
I suppose yes if the thief is hanging out nearby and scraping phone numbers and texting everyone 'hey did you make this purchase' in a manner that's professional-looking enough to trick the card holder, and that real cardholder is the only one who replies 'yes I'm trying to make the purchase' + the business is 'in on it' such that they're using a counterfeit payment terminal that will pretend to decline certain purchases such that the in-store criminals they're working with get the chance to perpetrate the text scheme, then yes, in that case, the criminal then adds knowledge of the phone number associated with the account.
So I'll stipulate that if the text comes in when you're at a small store that feels like it might be really sketchy generally, that's a higher risk. But that's not going to happen at, say, Costco or another similar large corporation. And you'd have to get pretty unlucky with "timing" because that's highly illegal stuff and the credit card companies will blacklist that business and report them to authorities pretty damn quickly, and they WILL act. The security of the systems by which people pay for purchases through bank cards drives the entire world's system of commerce is taken pretty seriously. A shop is not going to survive long as a business if they are actually a front for a credit card theft scheme. They'll get caught, and go to jail.
I'm pretty much saying there's one and only one scenario where, if you get an unsolicited text appearing to come from your institution (and you know your institution uses a system like this, like BofA does) that I think it's reasonable to respond to it. If others feel it's not worth the risk, I'm not faulting them for it. But you've brought me around to the idea that it carries SOME risk, esp. if you're at some sketchy outfit, like a roadside gift shop in the middle of Nowheresville.
Thanks for the talk 
I always used Google to check if those official-looking texts from ATT and a lot of the other companies were real, and they always said No.
Now I just Report and Delete them So many scam artists out there. 
I can see why he thought it was real, though. TY for this Pilot's harrowing cautionary tale, erronis. It's even more harrowing at the link
Sigh.. All that technology was making me dizzy. I kept hoping somehow the Police or FBI could catch the thief!
"The number, the FBI would later confirm, belonged to the genuine Apple Card support line. It had been spoofed so precisely that the messages accompanying the call arrived in the same gray bubbles, with the same Apple logo, that only real Apple support uses in iMessage."
The terms ("belonged to the genuine" and "only real Apple support uses" ) and "spoofed" are mutually exclusive.
Honestly this article could do a lot better job explaining which action he took caused which problem. Because taking this at face value, it implies literally any text you ever reply to, or any phone call you pick up, puts you in danger of your Apple ID instantly being compromised, and along with it, your SSN. The fact that any of this had anything to do with any supposed fraud alert seems coincidental, and I'm left wondering if the fraudsters could've done the exact same stuff w/o ever calling or texting. I think an important part of the interaction during the texts and phone calls is actually omitted here, perhaps at the request of Apple's lawyers as it could involve a vector they don't want to become known. 
