It’s been reported that some iPhone users have recently been targeted with an MFA bombing / multi-factor fatigue phishing attack.  

The attack (which uses a bug in Apple’s password reset feature) bombards the user’s phone with password reset requests and ‘Allow’ or ‘Disallow’ options. If the user eventually clicks on ‘Allow’ in an attempt to stop the many prompts, they receive a call from scammers pretending to be Apple Support, asking the user to verify a one-time code in an attempt to gain access to the account and/or to sensitive user information. 

So far, it’s understood that these attacks have been highly targeted at certain individuals and users should note that Apple Support will never call a user unless that user has specifically asked them to. It’s also been reported that turning on Apple Recovery Key for the account is a way to stop the multiple notifications generated by the scammers.