Your Spotify payment details are (not) out of date.
A Spotify-themed phishing email is circulating across NZ, using a real-looking sender domain and payment urgency to push you into handing over account or card details.
You could receive an email with the subject line "Action Required: Payment update required for your account!" that looks like an official Spotify account notice. It tells you your subscription payment has failed and urges you to update your payment method so your service is not interrupted. The message is designed to feel routine and urgent, like a normal billing problem you need to sort out straight away.
What makes this tricky is that the email can pass normal sender checks, so it may look legitimate at first glance. The sending domain, caleb.org.za, is not Spotify, even though the message is dressed up as a genuine Spotify notification. That means the email system may confirm the message came from that domain, but it cannot prove the sender is actually authorised to speak for Spotify. A clean domain reputation does not make the message safe, it only means the domain has not yet built a public record of abuse.
The attacker is trying to get you to click through and enter payment details, login credentials, or both into a fake page. If you engage, you could hand over access to your Spotify account, expose card information, or give criminals details they can reuse against other services. In a business setting, that same behaviour can open the door to wider credential theft and follow-on fraud.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Inspect the sender domain carefully. If an email claims to be from Spotify but comes from a different organisation, treat it as suspicious.
- Do not: Click payment update links or enter card details from an unsolicited email, even if it looks polished and urgent.
- Check: Go directly to Spotify through your saved app or official website and confirm any billing issue there.
- Report: Send suspicious messages to your IT provider or security team so they can block similar emails and review whether anyone engaged with them.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Spotify message looks like, the real sender domain, the real link destination, and where to report a fake.