Shifty Spotify payment email doing the rounds
A polished phishing email is impersonating Spotify and pressuring you to update your payment method after claiming your subscription payment failed.
You could receive an email with the subject line We cannot process your payment, appearing to be about Spotify Premium. It is dressed up like a routine billing notice, with a clean layout, a short explanation that your recent payment failed, and a prominent Update Payment Method button pushing you to act quickly.
What makes this one harder to spot is that the sending domain, tosantechno.com, has an established history and the email passed normal authentication checks. That means your mail system may treat it like a legitimate message even though it is impersonating Spotify. The giveaway is the context, not the polish. Spotify billing emails should come from Spotify, not an unrelated domain with no clear reason to handle subscription payments.
The attacker is trying to get you to click through and hand over payment details or account credentials on a fake page. If you engage, you could expose your card information, lose access to the account tied to that email address, or give criminals enough information to target your wider business systems.
This campaign has already been observed across multiple Microsoft 365 tenants in New Zealand in the last day. Treat any unexpected payment failure email with caution, especially if it pushes you to update billing details through a button in the message.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review any recent payment failure emails carefully and confirm billing issues by signing in through the official Spotify website or app, not through email links.
- Check: Look at the real sender address and domain before clicking. If the message claims to be from Spotify but comes from an unrelated organisation, treat it as suspicious.
- Do not: Click the Update Payment Method button or enter passwords, card details, or one-time codes from an unexpected billing email.
- Report: Send suspicious messages to your IT provider or security team so the sender, links, and any related mail rules can be reviewed and blocked.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Spotify message looks like, the real sender domain, the real link destination, and where to report a fake.
The Local Vocal is published by Decision1 IT Solutions. If one of these landed in your inbox, or someone in the team clicked, give us a call.