Fraudsters are sending convincing fake emails impersonating Spotify to trick users into handing over login details, personal information and payment card data. The scam works by claiming a subscriber's payment has failed and urging them to click a link to update their card details, which instead leads to a cloned website that harvests the entered information for criminals to use in fraudulent purchases.

One victim, referred to as Barry, told the Guardian he clicked the link without thinking while distracted, and quickly saw a suspicious credit card check followed by a Ticketmaster transaction worth roughly £469.22, which he managed to decline. He limited the damage by using a virtual credit card and changing his Spotify password. The fake emails closely mimic Spotify's branding, but tell-tale signs include the missing subscription tier, a lower-case subject line, a sender address not ending in @spotify.com, and a linked website with a non-Spotify.com domain. Spotify says it will never request personal details, passwords or payments via email, and advises anyone who receives such a message to log in directly via Spotify.com and report suspicious emails to spoof@spotify.com.