\u201cNetflix and chill\u201d has always been a pretty good entertainment option \u2014 that\u2019s how the company got to be as successful as it is \u2014 but it became even more so during 2020. When COVID took the option of going out to concerts, movies or bars off the table, people turned to the streaming giant (and its competitors) even more than before. <\/p>\n\n\n\n
Of course, some criminals viewed our collectively renewed reliance on Netflix as an opportunity. An especially skillful and dangerous Netflix scam email began to circulate in mid-summer 2020, and it\u2019s still making the rounds. It\u2019s a classic phishing attack, but executed well enough to fool even a wary user if you don\u2019t know what signs to look out for. <\/p>\n\n\n\n
The unusually sophisticated phishing email was described by email security provider Armorblox<\/a> in late July 2020. The email claims to come from Netflix Support, and although the language isn\u2019t exactly like real Netflix emails, it\u2019s not obviously wrong either. The pitch is that there\u2019s been an error in attempting to process your most recent payment, and that you need to update your payment information. There\u2019s a link provided, and a warning that if you don\u2019t respond within the grace period your account will be suspended. <\/p>\n\n\n\n If you click the link, you\u2019ll be taken to a functioning CAPTCHA page where you have to type in the characters you see in the box before you can proceed. Once you\u2019ve verified that you\u2019re human, a very realistic Netflix sign-in page will load. When you enter in your email or phone number and your Netflix password, you\u2019ll be taken to another very legitimate-looking page where you\u2019re prompted to enter in your name, date of birth, billing address and other personal information. Finally, you\u2019ll enter in your updated billing information. <\/p>\n\n\n\n At this point, having successfully carried out the Grand Slam of phishing attacks, the scammers redirect you to the legitimate Netflix login page. Some versions of the email<\/a> may also include what appears to be a text attachment, which \u2014 if downloaded \u2014 can add insult to injury by installing ransomware or malware on your computer as well. <\/p>\n\n\n\n This specific email, and the fake web pages associated with it, demonstrated a sophisticated understanding of how anti-phishing measures work and how they can be circumvented. Email providers typically scan the links in emails to check for dubious pages, but starting with a legitimate CAPTCHA page bypasses that protection (and has the added benefit of making victims feel that everything is above board). You don\u2019t get redirected to the actual phishing pages until you\u2019ve completed the CAPTCHA, so those URLS are hidden. <\/p>\n\n\n\n The attackers also covered their traces by hiding their phishing pages on domains owned by legitimate websites, which thwarts another test used to detect phishing attacks. Finally, the overall look and feel of the pages themselves showed an unusual level of skill and craft. They were not completely perfect, but they were very close indeed to matching the look and feel of Netflix\u2019s own pages. <\/p>\n\n\n\n That being said, if you already know the telltale signs of phishing emails<\/a>, you\u2019ll find them in this case as well. The first is simply that almost all<\/em> emails reporting a problem with your payment, or warning that your account will be shut down if you don\u2019t respond, are scams. Netflix itself will never ask you for personal information<\/a> via a text or email. A second is that the scam email probably won\u2019t be from an official netflix.com email address (though those can sometimes be spoofed, so it\u2019s not a certainty). <\/p>\n\n\n\n A more telling giveaway comes when you\u2019ve clicked through to the actual phishing pages, where your personal and billing information are harvested. If you look at the address bar in the top of your browser window, you\u2019ll see that you\u2019re not on a netflix.com page. The site\u2019s URL will vary, and it might sound somewhat Netflix adjacent, but it\u2019s not a Netflix page. At that point, no matter how convincing it looks, you\u2019ll know you\u2019re in the wrong place. <\/p>\n\n\n\n If you\u2019ve received one of these emails, you can forward it to phishing@netflix.com<\/a>. If your email is rejected, that just means the company has already been notified about that specific variant of the email. Don\u2019t click on any of the links, even from morbid curiosity (malware is always a risk). <\/p>\n\n\n\n If you have already fallen victim to this attack, you\u2019ll need to act quickly. Start by reporting it to the FTC\u2019s IdentityTheft.gov<\/a> website. Aside from making the authorities aware of your case, it provides you with a step-by-step recovery plan you can follow to minimize the damage and help restore your good credit as quickly as possible. You should also report the incident to the FBI\u2019s Internet Crime Complaint Center (IC3)<\/a>. Posting about it on the Better Business Bureaus Scam Tracker<\/a> and your own social media feeds may help someone else avoid being scammed. <\/p>\n\n\n\n Next you\u2019ll need to take several practical steps to limit the damage and begin recovery (your FTC recovery plan will walk you through this). Start by setting up a fraud alert<\/a> or credit freeze<\/a> with each of the three credit-reporting agencies, and informing them that you\u2019ve been a victim of identity theft. Talk to your bank or credit provider about setting up a new account or card to replace the one that\u2019s been compromised. If you have identity protection through a Spokeo subscription, set up Dark Web monitoring<\/a> to let you know when criminals offer your ID for sale on the Web\u2019s seamy underbelly. Finally, watch for the handful of common, telltale signs that your identity\u2019s been exploited<\/a>. <\/p>\n\n\n\n Although the Netflix email scam was executed with an uncommon level of skill, it still follows the same pattern as most other phishing emails: impersonating an authority of some sort, creating urgency through a deadline and the fear of losing out and then providing a link to \u201cfix\u201d your problem. If you\u2019re familiar with the pattern and watch for it, it\u2019s hard to be fooled (a bear in a top hat and tux is still recognizably a bear, after all). <\/p>\n\n\n\n A more important rule is that you never, ever<\/em> click the link in the email (or text). If you suspect there might be a legitimate issue (or you just want to rule out the possibility), log into Netflix the usual way and then click through to your account settings. You can also check your account statements to verify that the most recent payment went through without a problem, or \u2014 if in doubt \u2014 reach out to Netflix directly<\/a> to identify and correct any potential issue. <\/p>\n\n\n\n If you take those basic precautions, you\u2019ll sharply reduce the likelihood of ever falling victim to this or any other phishing scheme. <\/p>\n\n\n\n \u201cNetflix and chill\u201d has always been a pretty good entertainment option \u2014 that\u2019s how the company got to be as successful as it is \u2014 but it became even more…<\/p>\n","protected":false},"author":112,"featured_media":25479,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[614],"tags":[],"class_list":["post-25478","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-safety"],"yoast_head":"\nWhat Makes This Scam Dangerous (and Hard to Spot)<\/h2>\n\n\n\n
Identifying the Phishing Email<\/h2>\n\n\n\n
What To Do Next<\/h2>\n\n\n\n
Forewarned Is Forearmed<\/h2>\n\n\n\n
Sources<\/h4>\n\n\n\n