Netflix payment required? Not today.
A Netflix-themed phishing email is circulating across NZ, using a payment problem lure to push you into clicking and handing over account or payment details.
You could receive an email with the subject line "We have an issue processing your latest payment for your subscription." It presents as a Netflix customer service message, uses Netflix branding, and tells you there is a problem with your latest subscription payment. The aim is to make you act quickly, usually by clicking through to update payment details or restore your account.
What gives it away is that the message does not properly prove it came from a legitimate sender. The visible sending domain, 6d6a9a49ce.nxcli.io, has no established reputation as a genuine Netflix mail source, and key checks that normally help verify sender identity were missing or failed. In plain terms, your email system could not properly confirm who really sent it, even though the message was made to look tidy and convincing.
If you click, the attacker is likely trying to steal your Netflix sign-in, payment card details, or both. If you enter anything, those details can be reused for account takeover, fraudulent purchases, or follow-on attacks against your business using the same password elsewhere.
This campaign has been observed across multiple organisations in a short window, which means you should treat any unexpected Netflix billing message as suspicious. If someone in your business receives it, do not interact with it. Report it and verify any billing issue directly through the official Netflix website or app.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Where a reply to this message would actually be delivered. When it differs from the visible From address, an unsuspecting reply lands with the attacker instead.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at any Netflix billing email before you click. If the sender domain looks unfamiliar or unrelated to Netflix, treat it as suspicious.
- Do not: Click links or enter passwords or card details from an unexpected subscription payment email.
- Verify: Log in to Netflix directly through the official website or app to check whether there is actually a billing issue.
- Report: Use your email reporting process or send the message to your IT provider so it can be blocked for others.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Netflix message looks like, the real sender domain, the real link destination, and where to report a fake.