Scammers Use Spoofed FaceTime Calls to Harvest Bank Credentials and Drain Accounts
What Happened — Apple warned that fraudsters are spoofing FaceTime calls, impersonating banks or Apple support, and coercing victims into revealing passwords, 2FA codes, and other financial details. The attackers then use the disclosed information to empty bank accounts or make unauthorized Apple Pay charges.
Why It Matters for Compliance & Audit Readiness
- Social‑engineering attacks directly test the effectiveness of SOC 2 Access Control policies and employee awareness programs.
- Demonstrating documented security‑awareness training and incident‑response playbooks provides audit evidence that your organization mitigates credential‑compromise risk.
- Continuous monitoring of phishing‑simulation results can be leveraged as control‑testing evidence during a SOC 2 audit.
Who Is Affected – Financial services (banks, credit unions), fintech apps, and any organization whose customers rely on iOS devices for banking or payments.
Recommended Actions – Review and update your SOC 2 Access Control policies to include explicit guidance on unsolicited video/voice calls; run targeted security‑awareness simulations that cover FaceTime‑style scams; capture training completion and phishing‑test results as audit evidence. Source: Help Net Security
Technical Notes – Attack vector: spoofed FaceTime calls (caller ID spoofing) combined with social‑engineering scripts; no software vulnerability disclosed. Victims are asked to provide account credentials, 2FA codes, and sometimes to disable security features. Source: Help Net Security