Australian Netflix users are being urged to delete a scam email that leads to a "very clever" website that can dynamically change as you punch in your details.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
The Australian Communications and Media Authority detected the scam this week and immediately issued a warning, saying the email's subject line is: "Netflix Membership On Hold".
"These scammers are becoming increasingly sophisticated and the phishing websites very much replicate your experience when using the real website," said Bruce Matthews, manager of cybersecurity at the ACMA.
In the latest scam, subscribers are transported to a fake Netflix sign-in page that looks like the real one - even decked out with Daredevil movie imagery.
When a victim "signs in", the fake website feeds the username and password to the real website and obtains their full name.
Th victim hits the next page, which shows an "account verification" form. The first and last name fields are pre-populated, re-assuring the user that the website is genuine.
Once the user fills out the rest of the fields, such as home address, date of birth and mobile number, they're prompted to share their credit card details.
This is when the fake website begins to dynamically change. It will identify your financial institution based on the credit card number, and then accordingly ask for additional authentication by, for example, using "MasterCard SecureCode" or "Verify with Visa" boxes.
"If a particular bank asks for additional security information, it will determine that based on your credit card details and the form will change," said Mr Matthews. "It's a very clever website."
Cybersecurity experts now talk about "smart phishing", where forms can change and even identify incorrectly entered information, such as an invalid credit card number.
Scammers can use the information to steal identities and access financial accounts.
The code behind the fake website reveals that the con artists are targeting Australian users, although it can be easily modified for other jurisdictions.
"I think scammers follow the money trail and maybe assess how successful their campaigns are in various jurisdictions," said Mr Matthews.
He said users should also check the URL of the website, however this was becoming trickier with many now checking emails and browsing the internet on a mobile phone.
The Netflix website says users can keep their account safe by using a unique password and regularly changing it, being aware of possible phishing attempts, reporting fraudulent or suspicious activities and signing out of unused devices.
There are an estimated 1.03 million Netflix subscribers in Australia, according to research firm Roy Morgan. But Netflix's stunning growth phase in Australia appears to be over.
The latest alert follows a similar one in July, which was prompted by a targeted SMS that tried to get users of the popular streaming service to "update" their personal information.
This scam didn't ask customers for their credit card information.
