Netflix wants your payment? Not today.
A phishing email posing as a streaming billing notice is circulating across NZ, pushing you to update payment details through an unverified sender domain.
You could receive an email with the subject line "Reminder: Billing Information Needs Updating" that looks like a billing warning from the streaming service, Netflix. It tells you your recent payment details could not be validated and urges you to click an "Update Payment Information" button to avoid an interruption to your service. The message is sent from 2d72187777.nxcli.io, which does not match the brand it is pretending to be.
What gives it away is that the sending domain does not line up with the service named in the message, and the email systems checking it could not properly verify who really sent it. One part of the mail authentication passed, but the usual checks that help confirm a legitimate sender were missing or failed, which is a strong sign the message should not be trusted. Even if the domain has not yet built a bad reputation, that does not make it safe. It simply means there is little reliable history behind it as a genuine billing sender.
The attacker is trying to get you to click through and hand over payment details, account credentials, or both. If you engage, you could end up giving a criminal access to your account, exposing your card information, or opening the door to follow-up scams against your business. Treat this as a credential and payment theft attempt, not a real billing notice.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Where a reply to this message would actually be delivered. When it differs from the visible From address, an unsuspecting reply lands with the attacker instead.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Inspect any billing or subscription emails carefully before clicking, especially if the sender domain does not match the brand being referenced.
- Do not: Click payment update links in unexpected emails or enter card details after following an email prompt.
- Verify: Log in to the service directly from its official website or app to confirm whether there is a real billing issue.
- Report: Send suspicious messages to your IT provider or security team so the sender domain and any linked pages can be blocked.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Netflix message looks like, the real sender domain, the real link destination, and where to report a fake.
The Local Vocal is published by Decision1 IT Solutions. If one of these landed in your inbox, or someone in the team clicked, give us a call.