Your Netflix Subscription Has Expired Today - Payment Scam
Scammers are sending fake Netflix emails claiming that your payment has been declined and your account will be removed unless you update your billing information. These emails use urgency and fear to trick victims into giving away sensitive financial data.
The Scenario
The phishing email arrives with the sender name PaymentDeclined and a subject line like “Your account Netflix will be removed today ⚠️”. The message claims that the recipient’s Netflix subscription has expired and will be suspended within 24 hours unless payment details are updated. The email includes the victim’s email address and a fake subscription ID to look convincing. It also contains a large red button labeled “Update my payment details.”
However, the button redirects the user to a Google Cloud Storage link, not an official Netflix site. This fake site is designed to harvest credit card details and personal information.
The footer attempts to appear legitimate by offering an “unsubscribe” option, but it references List Armor, a service often associated with spam campaigns.
Clicking on such links may confirm to scammers that the email account is active. Additionally, the provided physical mailing address actually belongs to a Wendy’s restaurant, further confirming the scam. This scam is dangerous because victims who click and submit their payment information risk identity theft, financial fraud, and unauthorized charges.
Critical Warning
Red Flags to Watch For
🕵️ Suspicious Sender Name: Appears as “PaymentDeclined” with a long, random domain email address.
🔍 Urgent Threats: Claims your account will be removed within 24 hours to pressure quick action.
🚫 Fake Links: The payment button points to a Google Cloud Storage site, not Netflix.
How to Protect Yourself
Check sender addresses carefully – Real Netflix emails come from @netflix.com, not random domains.
Avoid clicking buttons or links in suspicious emails – Navigate to Netflix manually through your browser.
Do not use unsubscribe options in suspicious emails – They may be used to confirm active accounts.
Report phishing attempts – Use Gmail’s Report phishing feature or forward to phishing@netflix.com.
Investigated By
Tenzin Phuntsok
Threat Researcher