Spotify is (not) cancelling your subscription

You may see an email with the subject line "Your Subscription is Paused" that looks like a routine subscription or billing notice. It appears to come from hubspotfree.eu1.hs-send.com and claims there is a problem with your current billing information. It urges you to log in to your account overview, read more details, or update your payment details, which is designed to feel like a normal admin task you should sort out quickly.

What gives it away is that the sender setup does not fully line up, even though some of the usual trust checks appear to pass. The email failed an important sender verification check, which means the claimed sending system was not properly authorised to send on that domain's behalf. On top of that, any reply would go to an outlook.com address rather than back to the apparent sender, which is a strong sign the message is trying to separate the visible sender from where your response actually ends up. The sending domain also lacks the sort of established reputation you would want to rely on for a billing request.

The attacker is after action from you, either a click, a login, a reply, or payment-related details. If you engage, you could be pushed to hand over account credentials, disclose billing information, or start a back-and-forth with the attacker through the different reply address. That can lead to account compromise, fraudulent payment activity, or your business being drawn into a wider phishing chain circulating across NZ.