London: Spotify users are being warned about a sophisticated phishing scam that tricks subscribers into revealing their login credentials and payment details through fake emails claiming there is an issue with their subscription payments.
The scam begins with an email stating that a recent payment could not be processed and urging recipients to update their payment method to avoid service interruption. Because many users regularly renew or replace their payment cards, the request can appear legitimate.
Clicking the ‘Update Payment Method’ button takes users to a fraudulent website that closely resembles Spotify’s official login page. Victims are prompted to sign in and provide updated payment information, including their credit card details, address, and phone number.
The information is then harvested by cybercriminals, who may immediately attempt unauthorized purchases. Although the phishing email closely mimics Spotify’s branding, including its logo and colour scheme, there are several warning signs.
The email may come from an unfamiliar sender instead of a Spotify address, use an unusually formatted subject line, and omit subscription-specific details. Likewise, the fake login page may look authentic but operates on a domain unrelated to Spotify.
Unexpected payment-related emails
Spotify urged users never to click links in unexpected payment-related emails. Instead, subscribers should access their accounts directly through the official Spotify website or app to verify billing information or update payment methods.
A Spotify spokesperson said that the company never requests personal information such as passwords, payment details or government-issued identification through email. It also does not ask users to make payments through third-party services or download files from email messages.
Users are advised to inspect email headers and website addresses carefully to confirm they belong to the Spotify domain. Suspicious emails should be reported to email providers and forwarded to spoof at Spotify.
Anyone who has interacted with a phishing email should immediately change their Spotify password, review their account for unauthorized activity, and contact their bank if payment information may have been compromised.
Spotify also offers account recovery tools that allow users to regain access to their accounts and playlists by verifying ownership through proof of purchase, such as a Spotify receipt or bank statement.
ALSO READ | Fake X login emails target users in sophisticated scam
