Pretend Spotify payment not required...
A phishing email from safety.ru is impersonating Spotify and pushing you to update payment details after claiming your subscription payment failed.
You get an email with the subject line "We cannot process your payment", made to look like it is from Spotify. It says your recent Spotify Premium payment did not go through and urges you to click an "Update Payment Method" button. The message is plain text with highlighted boxes, built to look routine and urgent so you act before thinking.
What makes this tricky is that the email can appear technically clean, even though it is not from Spotify at all. It is coming from safety.ru, not a genuine Spotify system, and this is a cross-tenant phishing campaign already circulating in New Zealand environments. In plain terms, the email may pass basic checks in your mail system, but those checks only show the sending domain authorised the message, not that the sender is who it claims to be.
The attacker wants you to click through and hand over payment details, login credentials, or both on a fake page. If you engage, you could end up with a compromised account, fraudulent charges, or stored card details reused elsewhere. If the same password is utilised on business services, the impact can spread well beyond a single subscription.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Search your mailboxes for the subject line "We cannot process your payment" and any messages tied to safety.ru.
- Do not: Click the payment update button or enter card details, passwords, or one-time codes from this email.
- Verify: If you think there may be a real billing issue, sign in to Spotify directly through your saved app or official website, not through the email.
- Report: Mark the message as phishing in your mail platform and escalate it to your IT provider or security team for review.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine Spotify message looks like, the real sender domain, the real link destination, and where to report a fake.
The Local Vocal is published by Decision1 IT Solutions. If one of these landed in your inbox, or someone in the team clicked, give us a call.