Fake Spotify emails claim a subscriber’s credit card payment failed and warn that service could be interrupted.
A link takes victims to a cloned Spotify website designed to steal passwords, card numbers and other personal information.
Spotify says it never requests payment details or passwords by email; suspicious messages can be forwarded to spoof@spotify.com.
It's an old scam but with a new script. A convincing email targeting Spotify subscribers claims the streaming service was unable to process a credit card payment. But consumers who follow the email’s instructions could hand their passwords and financial information directly to criminals.
The message says Spotify encountered a problem while processing a recent payment and urges the recipient to update their information to prevent an interruption in service. An “update payment method” button appears to offer a quick solution.
However, the button does not lead to Spotify. It opens a cloned website that asks the victim to sign in and provide a credit card number, address and telephone number, according to The Guardian, which first reported the new version of the scam.
Scammers can then use the stolen card information to make purchases while also gaining the credentials needed to take control of the victim’s Spotify account. If the victim uses the same password on other websites, those accounts may also be at risk.
One victim told The Guardian that he clicked the link while distracted because his credit card was approaching its expiration date. Soon afterward, he received a suspicious card-verification request followed by an attempted Ticketmaster purchase worth the equivalent of about $630.
He was able to decline the purchase, cancel the virtual card he used for subscriptions and change his Spotify password.
The email looks like the real thing
The scheme may be particularly effective because the fake email closely copies Spotify’s legitimate communications. It uses the company’s logo, familiar green color scheme and MySpotify branding.
There are warning signs, however. The sender’s address does not end in “@spotify.com,” and the link directs users to a website outside the spotify.com domain. Other clues cited in the report include an all-lowercase subject line and the absence of the recipient’s specific Spotify subscription tier.
Consumers should not rely solely on professional-looking graphics or correct spelling to judge whether a message is genuine. Logos and email templates are easy for criminals to copy.
Payment problems are also a common phishing pretext. The Federal Trade Commission warns that scammers frequently impersonate familiar companies and claim there is a problem with an account or payment information. The manufactured urgency is intended to make recipients click before examining the message carefully.
What Spotify subscribers should do
Spotify says it will never ask customers to provide payment information, passwords or government identification numbers by email. The company also says it will not request payment through a third-party service or ask users to download software from an email.
Anyone receiving a payment-failure message should avoid its links and attachments. Instead, open the Spotify app or type Spotify.com directly into a browser and check the account from there.
Spotify lists several steps for handling a suspicious message:
Check whether the sender’s address ends in “@spotify.com.”
Do not respond, click a link or download an attachment.
Forward the suspicious email to spoof@spotify.com.
Report the message to the email provider and then delete it.
Consumers who entered a password on the fake site should immediately change their Spotify password and change it anywhere else they used the same credentials. Spotify also recommends reviewing the account for unauthorized changes.
Anyone who submitted credit or debit card information should contact the card issuer or bank immediately, cancel or lock the affected card and review recent transactions. Fraudulent charges should be reported promptly.
The FTC also accepts phishing and fraud reports at ReportFraud.ftc.gov.