I received two emails yesterday from Netflix. One said I’d changed my phone number, the other that I’d changed my email address. The former looked like this:
Now, I’d changed neither, so my conclusion was that this was a scam and that it was designed to get me to enter bank details to recover the account. Into the bin they went.
I’d frozen my Netflix account a few months ago, so I was surprised today to see that £6.99 had been taken from my account.
Clearly the emails weren’t spam; they were real. Some scumbag had hacked my account, changed the email and phone number and restarted the account, funded by muggins.
I just rang Netflix, at 11pm and expecting two hours on the line but much to my surprise I was answered in 30 seconds by a lovely lady in the Philippines (6am there) who closed the account down and will issue a refund. At least, I’m assuming that wasn’t a further part of an elaborate scam!!
How someone did it I don’t know, but if you get an email from Netflix that looks like mine, don’t ignore it. And do keep an eye on the bank account too. It’s the first time I’ve been hit with a scam, and I think I need to do more to make my passwords more secure.
Yeah, in the last week, I’ve had a couple of “Forgotten your password? Here’s a temporary one, log in and change….etc.” phishing though, rather than account hacking.
It’s good to hear that Netflix took it seriously, and responded appropriately.
I suspect the answer is no, but presumably your Netflix password wasn’t used elsewhere. I.e. Could it be the other website that this password is used that was hacked, then they tried all the main websites to see if the password had been reused elsewhere?
Whenever you get a borderline-plausible email like this, it’s a good idea to hover your mouse over the link (or press and hold if your using a phone) and look at the URL (web address). In this case, if it’s a Netflix domain, it’s almost certainly OK. If it’s not, it’s likely to be a phishing attempt. A couple of made-up examples:
A good Netflix link:
https://www.netflix.com/my-account/verify
A dodgy Netflix link:
https://bit.ly/a6^oz_16
A plausible looking but 100% dodgy Netflix link (because it’s trying hard to look like it’s on netflix.com while being on another domain):
If the computer literacy part of schools programs were restricted to teaching only one thing, a case could be made for teaching how URLs are structured. It would save a ton of fraud and identify theft, as well as teaching kids how to navigate around badly designed websites.
Thanks for the tips; I’ll certainly be taking a look at my passwords. Just one thing to add - I spoke to Netflix last night and within 15 hours the money taken has been refunded. We hear about poor customer service so often, but in this case the performance is truly impressive.
It’s tempting to put a short password in to make it easy to setup the login on the TV or set-top box.