From: Netflix Support <[email protected]>
Subject: Your account has been suspended
We were unable to validate your billing information. Your account will be closed in 24 hours unless you update your payment method now.
The email looks right: Netflix logo, red button, polite tone.
This is one of the most copied phishing emails in the world, and the same template is reused for Spotify, Disney+, Amazon Prime, PayPal and Apple.
How to tell in ten seconds
Look at the real sender address, not the display name. The name says "Netflix Support"; the address is [email protected] or [email protected]. Netflix only sends from @netflix.com (and @mailer.netflix.com). Anything with extra words around the brand - netflix-account, netflix-billing, netflixhelp - is not Netflix.
On a phone, tap the sender name to reveal the address. On desktop, hover over it.
The other tells
- A deadline. "24 hours", "immediately", "your account will be closed". Real billing failures give you days and multiple reminders, and your account keeps working in the meantime.
- A hidden link. The button leads to a shortener (
bit.ly,tinyurl) or a random domain. Netflix links go tonetflix.com. - "Dear Customer" / "Dear User". Netflix addresses you by the name on the account.
- Attachments. Netflix never sends invoices or forms as attachments.
What a real billing problem looks like
Netflix shows a banner inside the app and on the website when a payment fails. If you're unsure, that's the check: open the Netflix app or type netflix.com yourself, sign in, and look at Account → Membership & billing. Never go there from the email.
If you already clicked
- If you only opened the page: close it, nothing happened yet.
- If you entered your password: change it on netflix.com right now, and on any other site where you used the same password.
- If you entered card details: call your bank, freeze the card.
Paste it to be sure
Scamed will point at the sender domain, the deadline sentence and the link, and tell you how old the domain is.