If you receive an email saying your Netflix account has been compromised, do yourself a favor and ignore that email. It is a scam. Similarly, if you visit Netflix and end up on a site that looks like Netflix but shows you an “Important Notice” that “we have temporarily suspended this username”, that is also a scam. Netflix has not been hacked. Your Netflix account has not been compromised. Someone is just trying to get you to hand your personal information into the wrong hands.
This is just a phishing scam — a hacking trick that attempts to fool users into handing over their passwords, personal information and even their bank account information. And this version of the Netflix phishing scam is so ambitious that the scammers will attempt to get a picture of your ID and your credit card — providing them with your Social Security number and direct access to your finances.
The Netflix phishing scam was uncovered this weekend by a researcher at MalwareBytes, a San Jose-based malware-removal service. Victims of this scam are sent to a fake Netflix page (seen above) that reads “Important Notice: We have detected unusual activity on this account. To Protect your account from unauthorized use, we have temporarily suspended this username”. Victims are also provided with a 1-800 support number — and that’s where this scam gets really bad.
In this case, the hackers tried to hack the wrong guy. MalwareBytes security researcher Jerome Segura detailed everything the hackers tried to do, and even pinpointed their location in India.
You’ll notice that even though the website looks like Netflix, the actual URL is “netflix.afta3.com”. In other words, the owners of Afta3.com simply stuck the word “netflix” in the URL to look official.
When MSegura called the number (knowing it was a scam), the hackers answered and they kept up the act. They asked him to download “Netflix support software” which is just the hackers’ way of gaining backdoor access to your computer. They also tried to swipe as much data as possible from his computer during his “tech support” conversation.
Additionally, the hackers asked him to send pictures of his ID and credit cards “since the Internet is not secure and they needed proof of my identity”. Folks, there are no circumstances under which tech support would actually need a photo of your ID or credit cards.
If you’re curious just how these hackers operate,. Segura carefully documents each aspect of the scheme in a Netflix tech support scam video on YouTube.
The web site that purported the hoax is no longer active. Not a surprise, considering that they’ve been busted on a number of tech blogs in the three days since the scam was uncovered. But these suspicious hackers are likely to just resurrect the same scam using different URLs and web site addresses.
So do be careful around suspicious-looking Netflix security announcements. You are most likely to stumble across this scam by receiving a (fake) Netflix email or clicking on a (fake) Netflix ad. If the web address is anything other than “netflix.com” or “movie.netflix.com”, the site you are on is probably not Netflix.