1800 959 572 - 1800959572: Apple, PayPal and McAfee Impersonation Scams

• Scam
• Suspicious

1800 959 572 (1800959572): Multiple contributors report phishing emails impersonating Apple, PayPal, and McAfee with fake invoices and malicious attachments.

Apple, PayPal and McAfee Impersonation Scams Using 1800 959 572

Six contributors have flagged 1800 959 572 (also written as 1800959572) in connection with coordinated phishing scams impersonating major technology and payment companies. Rather than receiving calls directly, contributors are discovering this freephone number embedded in fraudulent emails claiming to be from Apple, PayPal, and McAfee security software. The emails attempt to convince recipients that unauthorised charges or security threats require immediate action by calling 1800 959 572.

The pattern across reports about 1800959572 is remarkably consistent: contributors receive emails with poor English grammar and spelling errors, sent from suspicious Gmail accounts or unknown domains, referencing payments or subscriptions the recipient never made. One contributor who received a phishing email noted the message mentioned a McAfee protection subscription charge alongside PayPal and references to an "Aussie.Market.Place." Another report describes an email with a fake invoice attached as a HEIC file, a format sometimes used to deliver malware.

What Scammers Claim in Emails Linking to 1800 959 572

Contributors report consistent messaging across the phishing campaigns using 1800 959 572. One contributor received an email claiming to be from PayPal stating a payment had gone through for a McAfee subscription, instructing them to call 1800 959 572 if there was a mistake in the payment. Another report describes an Apple iCloud email claiming a charge was made for a MacBook Pro the recipient doesn't own, with the freephone number provided as the contact point.

Multiple emails impersonating PayPal reference suspicious purchase activity or subscription charges that never occurred. One contributor specifically noted the email sender used no subject line, which is a common indicator of phishing attempts. A report about 1800959572 mentions the sender Gmail account looked legitimate at first glance but proved to be fraudulent when scrutinised. The emails consistently ask recipients to contact 1800 959 572 to "resolve" the fake charge or dispute the fake invoice, creating urgency to encourage immediate action.

Phishing Attachments and Malware Risk

Several contributors who received emails mentioning 1800 959 572 report concerning file attachments. One contributor described receiving a fake invoice as a HEIC file attachment, noting that HEIC files can potentially carry malware payloads. This contributor specifically advised updating phone security and running a virus scan if a HEIC file was downloaded. Another report mentions a fake invoice referencing PayPal, McAfee, and an illegitimate marketplace, again sent with the instruction to call 1800 959 572 if there were questions.

The technical sophistication of emails linking to 1800959572 varies: some use obviously poor grammar and unfamiliar sender addresses, while others attempt to mimic legitimate company email formatting. One contributor noted that despite appearing initially plausible, the emails contained grammatical errors and unusual phrasing that gave them away as fraudulent.

Report Patterns and Email Distribution

All eight reports about 1800 959 572 describe receiving phishing emails rather than direct calls, though two contributors mention answering calls linked to the scam emails. The clustering of reports in mid-October 2025, with earlier reports dating to late September, suggests an active campaign using this freephone number as the callback contact. One contributor reported receiving the number specified in two separate scam emails, indicating coordinated or repeated targeting.

Email addresses and domains associated with phishing campaigns using 1800959572 appear to vary by report, with contributors mentioning Gmail accounts and unfamiliar domains. The common thread is that the emails impersonate trusted companies (Apple, PayPal, McAfee) and attempt to establish false urgency about payment or security issues, directing recipients to call 1800 959 572.

What to Do If You Receive an Email Mentioning 1800 959 572

If you receive a suspicious email referencing 1800 959 572, take these steps:

• Do not: Call 1800 959 572, click any links in the email, or download any attachments
• Do not: Reply to the email or provide any personal, financial, or account information
• Do: Check your account directly by visiting the official website or calling the company's verified phone number (not any number in the email)
• Do: Report the email as spam and phishing to your email provider (for Gmail users, this helps reach Google's spam and phishing filters)
• Do: Delete the email and block the sender address
• Do: Run updated antivirus or security software on your device, especially if you downloaded any attachments
• Do: Report the phishing email to Scamwatch at scamwatch.gov.au

How to Verify Legitimate Company Communications

If you're unsure whether an email about a charge or security issue is legitimate, contributors who investigated emails mentioning 1800 959 572 found these verification steps effective:

• Log into your account directly on the company's official website (type the URL yourself rather than clicking email links)
• Check your actual account history for the transaction or charge mentioned in the email
• Call the company using a phone number from their official website, not from the email
• Look for tell-tale signs: grammar errors, unusual sender addresses, urgency tactics, requests for sensitive information, and unknown payment references
• Be especially cautious of emails about services you don't use (like PayPal if you've never signed up, or McAfee if you use different security software)

How to Report Phishing Emails Referencing 1800 959 572

• Scamwatch: Report phishing scams at scamwatch.gov.au with details about the email sender, subject, and any links or attachments
• ACMA (Australian Communications and Media Authority): Report spam and phishing emails at acma.gov.au, particularly if the email targets Australian users
• Email Provider: Report the email as spam and phishing to Gmail, Outlook, or your email service to help protect other users
• ReportCyber: If you believe you've been compromised or the phishing attempt involved identity theft, report to cyber.gov.au
• On Reverseau: Contribute your experience with 1800 959 572 to help other Australians identify this number in future phishing campaigns

Frequently Asked Questions