Is that "iCloud storage is full" email real?

An email arrives. It has the Apple logo at the top. It says your iCloud storage is full, or that your account has been blocked, and that your photos and videos will be permanently deleted in 48 hours unless you upgrade. There is a button. The amount it asks for is almost nothing, 99 cents, which is somehow the most convincing part.

Example, not a real email

From: Apple iCloud Support <icloud-billing-support@secure-id-verify-apple.net>

Action required: your iCloud storage is full

---

Dear Customer,

Your iCloud storage has reached its limit. Your photos, videos and documents will be permanently deleted within 48 hours unless you upgrade your plan today.

To keep your data, confirm your payment method for $0.99.

Upgrade my storage

It is usually not from Apple.

This has been running in waves through 2026, with reports clustering in April and again through September, and it is worth writing down properly because of who it works on. It does not work on people who are careless. It works on people who genuinely are running out of iCloud storage, which right now is a very large number of people, and who have been trained for a decade that the fix is to tap Upgrade.

The short version

• What is the email? A phishing message dressed as an Apple storage notice. It claims your storage is full or your account is blocked, and threatens deletion of your photos and videos within about 48 hours.
• What does it want? Not the 99 cents. It wants you on the payment form, where it harvests your card and banking details.
• What is the single clearest tell? The countdown. Apple does not threaten to delete your photos on a two-day deadline, and real storage notices do not arrive as an email with a link to an outside payment page.
• What should I do? Do not use the link. Open Settings on your own device and look. If there is a real problem, it will be there.

The detail behind those four answers follows.

What the emails actually say

The wording moves around, which is part of why filters keep missing it, but the shape is consistent:

• A subject line built on alarm. Variants reported this year include claims that the account has been blocked and that photos and videos will be deleted on a named date, and claims that the payment method on file has expired.
• Apple branding, laid out in HTML so it looks like a system message rather than a letter.
• A deadline, usually about two days out.
• A button: upgrade your plan, manage your storage, or update your payment method.
• A token amount. Asking for 99 cents rather than a real subscription price is deliberate. A small sum feels like an administrative formality rather than a purchase, so you think less before typing the card number.

Campaigns have been observed in English and in Spanish. The button leads to a page built to look like an Apple payment screen, and what happens there is the whole point of the exercise: the form collects card and banking details, and the 99 cents is never the objective.

Why it is landing right now

Two things made this autumn fertile ground.

The first is that storage pressure is real and widespread. The free iCloud tier is 5GB and has been since 2011. A modern phone fills that with a long weekend. Most people carrying an iPhone have seen a genuine "storage almost full" notice at some point, which means the fake one is not asking them to believe anything new.

The second is more specific. In iOS 27, Apple changed how Shared Albums work: new and upgraded albums keep full resolution and lose the old 5,000-item cap, and in exchange everything in them counts against the album owner's iCloud storage, including photos other people add. We wrote that change up in September in Before you upgrade your family's shared album. The relevant part here is that a lot of people have spent the last few weeks being prompted, legitimately, by Apple, to think about their storage and consider an upgrade.

A scam that imitates a prompt you have genuinely been receiving is a different problem from a scam that invents one.

Five checks, under a minute

1. Look at the deadline

This is the fastest tell. Apple does not run a 48-hour countdown to deleting your photos. When you exceed your storage, iCloud stops backing up and stops syncing new material. Your existing photos stay where they are. There is no cliff, and there is certainly not one two days away.

Any message that puts a timer on the destruction of your memories is applying pressure, and pressure is the product.

2. Check the sender address, not the sender name

The display name will say Apple, or iCloud, or Apple Support. That field is free text and anybody can type anything into it. What matters is the actual address behind it, which on these messages resolves to a domain that has nothing to do with Apple.

On an iPhone, tap the sender name at the top of the message to expand the real address. On a Mac, hover over it. Apple's own mail comes from apple.com or icloud.com.

3. Notice where it is asking you to go

A real storage problem is a thing that exists inside your device. Apple surfaces it in Settings and in system notifications, not as an email containing a link to an outside payment page. If the only route to fixing the problem is the button in the email, that is the answer.

4. Go and look yourself

Do not use the link. On an iPhone or iPad, open Settings, tap your name at the top, then iCloud. The storage bar is right there. On a Mac, System Settings, your name, then iCloud.

If your storage is genuinely full, you will see it. If it is not, you have your answer. Either way you now know something the email cannot tell you, because you checked at the source.

5. Treat the payment framing as the tell it is

Apple does not ask for a nominal fee to stop your data being deleted. That sentence does not describe anything Apple does. A real billing problem, such as an expired card on an existing subscription, shows up in Settings under your Apple Account, and you fix it there without anybody emailing you a link.

If you already clicked

This is worth saying plainly, because the people most likely to fall for this are the people least likely to tell anyone about it. Clicking a link is not a catastrophe. Entering details is the part that needs action, and acting quickly matters more than feeling foolish.

• If you entered card or bank details: contact your bank or card issuer now and tell them the card is compromised. They will freeze and reissue it. Do this before anything else.
• If you entered your Apple Account password: change it immediately from Settings on your own device, not from any link. Then check that two-factor authentication is on, and look at the list of devices signed in to your account for anything you do not recognise.
• If you reused that password anywhere else: change it there too. Credential stuffing, where a password lifted from one place is tried everywhere else, is the normal second step.
• Either way: watch your statements for small test charges over the following weeks. Card fraud frequently opens with an amount small enough to be ignored.
• Report it. Forward the message to Apple at reportphishing@apple.com and then delete it.

And tell whoever in your family is most likely to receive the same email. That conversation is worth more than any filter.

What Apple actually does

For completeness, so you have something to compare against:

• Storage warnings appear on the device, in Settings and in notifications.
• Running out of storage stops new backups and syncing. It does not delete what you already have.
• Billing problems appear in your Apple Account settings, and are fixed there.
• Apple's email comes from apple.com or icloud.com, and does not route you to a third-party payment page.
• Apple will not ask you for your password, a verification code, or card details by email in order to prevent a deletion.

The part that is structural

You can be careful, and you should be. It is still worth noticing what makes this attack possible at all.

The scam works because the relationship it describes is real. Your family's photographs sit on somebody else's computer, under an account, on a plan, with a payment method and a renewal date attached. A message claiming something has gone wrong with that arrangement is plausible because the arrangement exists. The attacker is not inventing a relationship. They are using one that already exists — and that you cannot easily inspect.

Almost none of these messages work against a thing you own outright. A hard drive in your house has no account to suspend, no plan to lapse, no card to expire. There is nothing for a stranger to claim has gone wrong, because there is nothing between you and your files but a power cable.

That is the reasoning behind The Ark: your family's photos, messages and files on a device in your home, on hardware you own, accessible from your phone anywhere. Phishing emails will keep arriving — nothing stops that. What they can no longer do is touch your photos: nothing can put them on a deadline, lock them behind a lapsed payment, or take them away, because nobody else holds them.

In the meantime: check the deadline, check the sender, and open Settings yourself. That is almost always enough.