A text or email says your Netflix, Amazon Prime, or Disney+ payment failed — the link steals your card details
A fake billing alert by text or email warns that your streaming subscription (Netflix, Amazon Prime, Disney+, Crave) failed payment. Clicking the link opens a convincing fake login or billing page that captures your password and full credit card details. Active Vercel-hosted Netflix phishing clusters observed October 2026.
Also known as: fake Netflix billing scam Canada, streaming subscription payment failed text Canada, Amazon Prime account suspended phishing Canada, fake Crave subscription renewal scam, Disney Plus payment failed email Canada
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
What to do right now
- 1 Do not click the link. Open the streaming service's official app or go directly to their website by typing the URL yourself to check your account status
- 2 If you entered your credit card details: call your card issuer immediately to report fraud and request a new card
- 3 If you entered your streaming account password: change it now and enable two-factor authentication on that account
- 4 Forward the phishing text to 7726 (SPAM) and report the URL to the Canadian Centre for Cyber Security at cyber.gc.ca
- 5 Report to the Canadian Anti-Fraud Centre at https://antifraudcentre-centreantifraude.ca or call 1-888-495-8501.
Red flags
- ⚠ An unexpected text or email says your subscription payment failed and your account will be suspended — streaming services do not send urgent cancel-or-pay ultimatums this way
- ⚠ The sender's domain or URL is not the company's official domain (netflix.com, amazon.ca, disneyplus.com) — fake URLs use hyphens, subdomains, or are hosted on .vercel.app, .app, or random .com domains
- ⚠ You are asked to re-enter your full credit card number, CVV, and expiry — legitimate billing updates happen inside the official app or site after you sign in normally
- ⚠ The message creates urgency — 'Your account is on hold. Update payment in the next 24 hours to avoid losing your subscription'
- ⚠ The email originates from a Gmail, Outlook, or non-corporate domain rather than a @netflix.com or @amazon.com address
Sources
- iPhone in Canada — Canadian Netflix Users Being Targeted by Phishing Scam (updated 2026)
- CBC News — Netflix Canada warns users of phishing scam claiming account suspension
- The Tech Outlook — Netflix users targeted by cybercriminals in new phishing scam (July 31, 2026)
- Emerging signals triage October 12, 2026 — 9 active Vercel-hosted Netflix phishing clusters (no geo-gate; confirmed targeting English-speaking subscribers including Canada)