This article discusses a scam that impersonates cloud storage providers, including Apple’s iCloud. Neither Apple, iCloud, nor any legitimate cloud storage provider is involved in the scam. All third-party company names, product names, brand names, and trademarks referenced in this article are the property of their respective owners.

A text arrives while you’re scrolling on your phone. It says your cloud drive is full, a payment failed, and hundreds of your files will disappear in six hours unless you tap the link. It even uses your first name, so it feels personal, urgent, and real. That is exactly what it’s designed to do. Between June 17 and August 7, 2026, TrendLife flagged 8,607 of these messages, almost all in the US. Here’s how the scam works, what to watch for, and how to stay safe.

How the scam works

1. A text claims your cloud storage is about to be deleted

The message opens with your first name and a manufactured deadline: your plan was paused, your backup expires soon, or thousands of files will be wiped in a few hours. Scammers pull names from bulk contact lists, which is why some texts arrive addressed to “null” when the list has no name attached to a number. The wording stays vague on purpose (“your cloud,” “cloud files”) so the same message looks plausible whether you use Apple’s iCloud, Google, or anyone else.

2. The link leads to a fake billing or login page

Tapping the link opens a page built to look like a real cloud storage payment portal. It asks you to “restore billing” by entering your card number, expiry date, and CVV. Some versions show a fake login screen first, so the scammers collect your cloud password before the payment step.

3. Scammers use your details for fraud and account takeover

Card details can be used for unauthorized charges or sold online, often as recurring “subscription” charges you might not notice for months. What’s worse, if you entered your cloud password, scammers could sign in to your linked email and any service that relies on that account to reset passwords. One captured password can open several doors.

Red flags to watch for

You’ve got this. Here’s what to watch for.

1. A countdown to permanent deletion: Real providers don’t delete paid data within hours. A “6 hours” or “12 hours” threat is pressure, not policy.
2. A vague greeting or an obvious placeholder: “Your cloud” with no provider named, or a literal “null” or blank space where your name should be, means it came from a bulk list.
3. An unfamiliar link domain: Random strings of letters ending in .com are a strong sign of a scam page, not your provider.
4. A request for card and password on the same page: Legitimate storage warnings don’t funnel you straight into re-entering payment and login details.
5. A payment or storage warning sent by text: Providers rarely handle billing problems through an SMS link.

How to stay safe

1. Go to the source yourself. Don’t tap the link. Open your provider’s official app or type the website address in yourself to check your account.
2. Treat countdowns as a red flag. Slow down. The urgency exists to stop you from verifying it.
3. Check the link domain. A random, unfamiliar web address is a clear warning sign.
4. Never enter card or password details at a link that came from a message. Only enter them on a page you opened yourself.
5. Turn on multi-factor authentication. Use a unique password for your cloud account so one leak doesn’t spread.
6. Act fast if you have already entered the details. Contact your bank to block the card, change your cloud password right away, and report it to the FTC at ReportFraud.ftc.gov.
7. Use Trend Micro ScamCheck. It can help flag suspicious links before you tap them.

The good news

These texts are built to feel personal and urgent, and even careful, tech-savvy people encounter them every day. The scammers are counting on speed, so the moment you slow down and check your account directly, their whole plan falls apart. You already know the pattern now: a scary deadline, a random link, and a page asking for your card. Trust that instinct, take your time to verify, and you’re already ahead.