AppleInsider confirms that extracting a real email from Hide My Email is straightforward, yet it poses little risk if the feature is used as intended for spam filtering.

The service lets iPhone, Mac, and iPad owners sign up with an anonymous alias that forwards all mail to their real address. Reports show the alias can be bypassed, but Apple has known about the flaw for over a year and has yet to release a fix.

Bypassing is trivial—an attacker simply needs to know the alias—which limits the attack vector. Many services, like grocery delivery or media sites, rarely chase personal emails, and the lawsuit over false advertising, fraud, and breach of contract still looms.

Apple stresses that Hide My Email is meant for privacy and spam control, not a shield from determined attackers. The real email can still be uncovered via subpoena, but the overall risk remains modest.