Any chance this is legit?

[wdfifteen]

I didn't request a change in my Apple ID and this was not sent to the email address that my Apple receipts are sent to.

Dear (my full name),
You recently requested a password reset for your Apple ID. To complete the process, click the link below.
Reset now >
If you didn’t make this change or if you believe an unauthorized person has accessed your account, go to iforgot.apple.com to reset your password immediately. Then sign into your Apple ID account page at https://appleid.apple.com to review and update your security settings.
Apple Support

The URL in the last line appears to be legit. The iforgot.apple.com goes to a nice looking web site, but I really doubt it is a legitimate Apple address. Am I wrong?

[Scott Douglas]

I wouldn't trust the embedded link, but if you type in the site yourself I'd think you'd get a legit site.
The embedded link could lead to a false site.

[stomachmonkey]

Simplest way to validate this stuff is view the message headers and see where the mail actually came from.

I could send mail all day that looks like it came from anyone I choose but the headers never lie.

[Pazuzu]

A google search shows that the iforgot.apple.com thing is 100% real, and has been around for years.

So, go there, wipe your info, change your password, then go to whatever normal login stuff you do (I don't know apple stuff).

[wdfifteen]

Hmmm. The link goes to:

https://iforgot.apple.com/verify/email?key=3DXXXXXX02e5218544ec4c2cb6ab6d93=
786f5d5a106a6e6c43c82b0f77a5fd39153cc0e6LTOW&language=3DUS-EN

Verify email? The email was not sent to the email address that I've used at apple.com for ten years. By clicking the link did I just verify to someone that this is a legit email address?

Scott - the header is a mile long and I don't understand any of it. I looked at half a dozen other headers and none of them have an emoticon stuck in the middle. That seems odd.


Delivered-To: me@gmail.com
Received: by 10.79.115.138 with SMTP id y10csp598291ivf;
Thu, 11 Feb 2016 22:19:08 -0800 (PST)
X-Received: by 10.98.44.73 with SMTP id s70mr31764080pfs.2.1455257948015;
Thu, 11 Feb 2016 22:19:08 -0800 (PST)
Return-Path:
Received: from mdn-txn-msbadger0302.apple.com (mdn-txn-msbadger0302.apple.com. [17.171.37.39])
by mx.google.com with ESMTPS id hr2si310217pac.7.2016.02.11.22.19.07
for
(version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128);
Thu, 11 Feb 2016 22:19:07 -0800 (PST)
Received-SPF: pass (google.com: domain of appleid@id.apple.com designates 17.171.37.39 as permitted sender) client-ip=17.171.37.39;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of appleid@id.apple.com designates 17.171.37.39 as permitted sender) smtp.mailfrom=appleid@id.apple.com;
dkim=pass header.i=@id.apple.com;
dmarc=pass (p=REJECT dis=NONE) header.from=id.apple.com
DKIM-Signature: v=1; a=rsa-sha1; d=id.apple.com; s=id2048; c=relaxed/relaxed;
q=dns/txt; i=@id.apple.com; t=1455257946;
h=From:Subjectate:To:MIME-Version:Content-Type;
bh=7DaViI4KRwD9gRO0l7AZaMJ91us=;
b=SOEhtMZjAWB2e9mYQUbI2v1SKJ0Lhp/h5FSPhNhy81VhdRdY3OVOlRBu/rpRdBgz
1bCpjqFspYGvut9cLTSOQkfeZev45t3Qw+ht9K6i6ImTXuGEmn dh9NifL3lfLyHP
nC51CtNVu+/cl1cInULFq6ywbNbxwRxVW2P75RVNh9bije0gGKzF0uvDfjTEJ Mmn
yOKJ3i0esCwd+aJ11FRAensP5k3loeeUfmQBJmXW5NQv74FSRF LsGTmMIAwXYXCe
nOWdO3uMjRgdl3+Tl/FLo+vLAqMreoeugOF14Byy0O57AFGdldbI/IUHY7+LmvPv
B+bZoOlqybP6GkybRrzt3w==;

[foxpaws]

If you wonder about the link - go through the 'legit' apple site and reset your password there - apple.com

[Scott Douglas]

+1 to what foxpaws says above.

[Pazuzu]

Originally Posted by foxpaws

If you wonder about the link - go through the 'legit' apple site and reset your password there - apple.com

And when you do that it takes you to...

iforgot.apple.com.

It's valid. Not a scam. Not spam. Not hacking. As valid as can be when dealing with an evil company like Apple