Scammers love to impersonate trusted brands—ranging from big tech names like Microsoft and Google to password managers and payment apps—in their phishing campaigns to lure their marks, and their latest guise is Spotify. A new email is circulating alerting users to supposed payment issues, prompting them to hand over their credit card details and Spotify login credentials.
Phishing emails use Spotify branding
As The Guardian reports, Spotify users have received messages with the subject line “review billing info” claiming that the platform “encountered an issue while processing your recent payment.” Recipients are urged to “review and update” their information to keep their accounts active. The button in the email directs users to a spoofed website, where users are prompted to enter their username and password, followed by their credit card number, address, and phone number—everything scammers need to make fraudulent purchases. One victim reported seeing a suspicious charge for more than $600 within minutes of handing over their information.
The emails closely replicate Spotify’s branding, including its colors and logo, and appear to come from a sender called MySpotify. The fraudulent website also looks convincing at first glance. However, unlike some of the more sophisticated phishing schemes that exploit vulnerabilities in order to use real domains (like Google and PayPal), this one from Spotify breaks down when you look closer.
For one, both the sender’s address and the website URL clearly are not connected to spotify.com or any legitimate subdomain. The subject line is all lowercase, and there are no specifics about users’ subscriptions or accounts in the email body.
How to avoid getting scammed by Spotify impersonators
Payment issues are a common scam tactic, and you should always be skeptical of any communication that urges you to provide or update banking or credit card info (or sends you to a login page along the way, which is designed to harvest your credentials). If you receive a notification from Spotify about failed payments, don’t click links, download attachments, or reply. Spotify won’t request payment info, passwords, or other sensitive information over email.
If you’re concerned about a payment or subscription problem, go directly to your account in the Spotify app or a web browser instead. If you’ve already entered your Spotify credentials into a suspicious site, change your password and keep an eye on your credit card transactions to catch any fraudulent charges. You can also forward phishing emails to spoof@spotify.com.
