Fake Netflix note wants your card details
A phishing email impersonating Netflix is circulating across NZ, urging you to update your account after email checks failed to verify the sender.
You get an email with the subject line "update your account", appearing to be about Netflix billing. It pushes a headline about updating your payment details and urges you to click an "update account now" button, making it look like your subscription or card details need urgent attention.
What gives it away is that the email could not properly prove who sent it. The usual checks that help confirm a sender was authorised failed or came back weak, which means your mail system had no reliable way to verify it was genuinely from Netflix. It also came from cashbuddy.ng, a domain with no established history as a legitimate Netflix sender, which is another strong sign the branding was faked.
The attacker is trying to get you to click through and hand over account or payment details on a fake page. If you engage, you could expose your login, card information, or both, and that can lead to account takeover, fraudulent charges, or follow-on scams using the details you entered.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review the sender address and domain carefully before clicking, especially if the message claims to be from a streaming or payment service.
- Do not: Click account update buttons in unsolicited emails or enter payment details from links sent to you.
- Verify: Go directly to the official Netflix website or app yourself if you think there may be a genuine billing issue.
- Report: Mark the message as phishing and notify your IT provider or security team so they can block similar emails.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Netflix message looks like, the real sender domain, the real link destination, and where to report a fake.