Return to Answer

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:

More generally, the phishing scam here is:

1. Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.
2. Create a Netflix account with address james.hfisher.
3. Sign up for free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the cancelled card. Then Netflix emails james.hfisher asking for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card **** 1234.
7. Change the email for the Netflix account to [email protected], kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

(Note that the above steps don't include any "password reset" step for Jim to access the account; that's because the email from Netflix includes authenticated links that won't ask for it. The attacker wants the victim to click on the email links instead of visiting Netflix manually, this is what enables "Eve" to log back in to the account in step 7. Or, since Netflix emails authenticated links, possibly "Eve" already has one.)

The above situation is partially caused by Netflix not recognizing Gmail's "dots don't matter" feature where email sent to [email protected] and to [email protected] end up in the same account. That doesn't really matter in your case (given that if this is how you're trying to be scammed, step 1 was skipped entirely), however. A bigger problem is that Netflix apparently still allows people to register email addresses to accounts without verification.

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:

More generally, the phishing scam here is:

1. Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.
2. Create a Netflix account with address james.hfisher.
3. Sign up for free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the cancelled card. Then Netflix emails james.hfisher asking for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card **** 1234.
7. Change the email for the Netflix account to [email protected], kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

(Note that the above steps don't include any "password reset" step for Jim to access the account; that's because the email from Netflix includes authenticated links that won't ask for it. The attacker wants the victim to click on the email links instead of visiting Netflix manually, this is what enables "Eve" to log back in to the account in step 7. Or, since Netflix emails authenticated links, possibly "Eve" already has one.)

The above situation is partially caused by Netflix (understandably) not recognizing Gmail's "dots don't matter" feature where email sent to [email protected] and to [email protected] end up in the same account. That doesn't really matter in your case (given that if this is how you're trying to be scammed, step 1 was skipped entirely), however.

A bigger problem is that Netflix apparently still allows people to register email addresses to accounts without verification.

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:

More generally, the phishing scam here is:

1. Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.
2. Create a Netflix account with address james.hfisher.
3. Sign up for free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the cancelled card. Then Netflix emails james.hfisher asking for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card **** 1234.
7. Change the email for the Netflix account to [email protected], kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

(Note that the above steps don't include any "password reset" step for Jim to access the account; that's because the email from Netflix includes authenticated links that won't ask for it. The attacker depends on the victim clicking on the email links instead of visiting Netflix manually, this is what enables "Eve" to log back in to the account in step 7.)

The above situation is partially caused by Netflix not recognizing Gmail's "dots don't matter" feature where email sent to [email protected] and to [email protected] end up in the same account. That doesn't really matter in your case (given that if this is how you're trying to be scammed, step 1 was skipped entirely), however. A bigger problem is that Netflix apparently still allows people to register email addresses to accounts without verification.

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:

More generally, the phishing scam here is:

1. Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.
2. Create a Netflix account with address james.hfisher.
3. Sign up for free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the cancelled card. Then Netflix emails james.hfisher asking for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card **** 1234.
7. Change the email for the Netflix account to [email protected], kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

(Note that the above steps don't include any "password reset" step for Jim to access the account; that's because the email from Netflix includes authenticated links that won't ask for it. The attacker wants the victim to click on the email links instead of visiting Netflix manually, this is what enables "Eve" to log back in to the account in step 7. Or, since Netflix emails authenticated links, possibly "Eve" already has one.)

The above situation is partially caused by Netflix not recognizing Gmail's "dots don't matter" feature where email sent to [email protected] and to [email protected] end up in the same account. That doesn't really matter in your case (given that if this is how you're trying to be scammed, step 1 was skipped entirely), however. A bigger problem is that Netflix apparently still allows people to register email addresses to accounts without verification.

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:

More generally, the phishing scam here is:

1. Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.
2. Create a Netflix account with address james.hfisher.
3. Sign up for free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the cancelled card. Then Netflix emails james.hfisher asking for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card **** 1234.
7. Change the email for the Netflix account to [email protected], kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

(What isn't clear from the article is how "Eve" logs back in to reclaim the account in step 7. Possibly Eve retains an authentication token that does not get revoked when the password is reset.)

The above situation is partially caused by Netflix not recognizing Gmail's "dots don't matter" feature where email sent to [email protected] and to [email protected] end up in the same account. That doesn't really matter in your case (given that if this is how you're trying to be scammed, step 1 was skipped entirely), however. A bigger problem is that Netflix apparently still allows people to register email addresses to accounts without verification.

I think it's likely that someone is trying to trick you into paying for Netflix for them. From: https://jameshfisher.com/2018/04/07/the-dots-do-matter-how-to-scam-a-gmail-user/:

More generally, the phishing scam here is:

1. Hammer the Netflix signup form until you find a gmail.com address which is “already registered”. Let’s say you find the victim jameshfisher.
2. Create a Netflix account with address james.hfisher.
3. Sign up for free trial with a throwaway card number.
4. After Netflix applies the “active card check”, cancel the card.
5. Wait for Netflix to bill the cancelled card. Then Netflix emails james.hfisher asking for a valid card.
6. Hope Jim reads the email to james.hfisher, assumes it’s for his Netflix account backed by jameshfisher, then enters his card **** 1234.
7. Change the email for the Netflix account to [email protected], kicking Jim’s access to this account.
8. Use Netflix free forever with Jim’s card **** 1234!

(Note that the above steps don't include any "password reset" step for Jim to access the account; that's because the email from Netflix includes authenticated links that won't ask for it. The attacker depends on the victim clicking on the email links instead of visiting Netflix manually, this is what enables "Eve" to log back in to the account in step 7.)

The above situation is partially caused by Netflix not recognizing Gmail's "dots don't matter" feature where email sent to [email protected] and to [email protected] end up in the same account. That doesn't really matter in your case (given that if this is how you're trying to be scammed, step 1 was skipped entirely), however. A bigger problem is that Netflix apparently still allows people to register email addresses to accounts without verification.