Spotify is the number one audio streaming service globally, boasting 515 million users, of which 40% are paid subscribers. Given they have customers in 184 regions, it’s not surprising that they’re an attractive target for impersonation by scammers looking to make a quick buck.
Today, our team at MailGuard intercepted and began blocking a new phishing email that masquerades as the streaming giant and has the subject line: “Spotify: We’re unable to bill you.” The sender name reads “Last Reminder”, but it's actually sent from what appears to be a compromised support account belonging to a South African business.
The email has the Spotify logo in the header, and then explains to the recipient that their payment details need updating as they have been unable to process a payment. Just above the button to “Update information”, the email warns “You will lose access to your account if there is no payment method associated with your account”. This is a tactic that cybercriminals commonly employ to create a sense of fear and urgency. By threatening to revoke access, the attacker aims to manipulate the recipient into taking immediate action without thinking critically about the tell-tale signs of a scam hidden in the email and phishing page.
Here's what the email looks like:
When the recipient clicks the button, they’re immediately directed to a phishing page which again uses Spotify branding and asks that they update payment details, including:
- First name
- Last name
- Address
- City
- Postcode
- Card number
- Expiration date
- CVV
With these details, a scammer can engage in various malicious activities, such as identity theft and financial fraud.
After being shown a loading page, the victim is asked to enter a one-time authorisation code to verify the transaction. These verification pages are commonly used when purchasing items online, so it may not raise suspicion in the victim. However, in phishing attacks, it’s often an indication that the scammer is attempting to charge the victim’s card to confirm its validity.
Spotify warns that it will “never ask for personal information over email”, including:
- Payment info
- Password
- Social Security or tax identification number
They will also never:
- Request payments via a 3rd party (e.g., through a bank), or
- Ask you to download anything
MailGuard advises all recipients of this email to delete it immediately without clicking on any links. Providing your personal details can result in your sensitive information being used for criminal activity and may have a severe negative impact on your business and its financial well-being.
MailGuard urges users not to click links or open attachments within emails that:
- Are not addressed to you by name.
- Appear to be from a legitimate company but use poor English or omits personal details that a legitimate sender would include.
- Are from businesses that you were not expecting to hear from, and/or
- Take you to a landing page or website that is not the legitimate URL of the company the email is purporting to be sent from.
Many businesses turn to MailGuard after an incident or a near miss, often as a result of an email similar to the one shown above. If unwanted emails are a problem for your business, don’t wait until it’s too late.
Reach out to our team for a confidential discussion by emailing expert@mailguard.com.au or calling 1300 30 44 30.
One email is all that it takes
All that it takes to devastate your business is a cleverly worded email message that can steal sensitive user credentials or disrupt your business operations. If scammers can trick one person in your company into clicking on a malicious link or attachment, they can gain access to your data or inflict damage on your business.
For a few dollars per staff member per month, you can protect your business with MailGuard's predictive and advanced email security. Talk to a solution consultant at MailGuard today about securing your company's inboxes.
Stay up-to-date with MailGuard's latest blog posts by subscribing to free updates. Subscribe to weekly updates by clicking on the button below.
