How to tell the difference between a legitimate Apple request for my password, and an app phishing attempt?
If an app pops up a modal that looks just like the Apple password request modal, how can I tell the difference?
https://krausefx.com/blog/ios-privacy-stealpassword-easily-get-the-users-apple-id-password-just-by-asking
Press on the Home button on your device - if the app quits, it is a fake popup. If the app persists, it is real.
The safest is to always assume that the popup is fake. Then access the Apple supplied program that supposedly gave the popup (for example Settings => iCloud) and enter your password there if indicated.