This article discusses a scam that impersonates Netflix. Netflix and its services are not involved in the scam. All brand names are trademarks of their respective owners.

A text lands on your phone: your Netflix payment was declined, and your account will be suspended in 24 hours. The message looks routine, the kind of billing notice you’d expect from a streaming service. But the link doesn’t go to Netflix. It goes to a phishing site built to collect your password, your credit card number, and your personal details. Netflix impersonation scams have been around for years. The 2026 versions are harder to spot because the fake pages are pixel-perfect clones of Netflix’s real login and payment screens, complete with working reCAPTCHA badges and PayPal buttons. Here’s how they work and what to watch for.

How the scam works

1. A billing alert text pressures you to act within 24 hours

The text arrives by SMS and reads like a standard Netflix notification. It says your last payment was declined, your account is about to be suspended, or your streaming access has been restricted. A short deadline, usually 24 hours, pushes you to tap the link without checking. Here’s what one of these texts looks like:

NETFLIX: We were unable to process your latest payment. Please update your payment to avoid service interruption.

The message starts with “NETFLIX:” and is written in clean, service-style language with no obvious spelling errors. The link in the text is a short tracking URL, not a Netflix address. These messages are also designed to slip past your phone’s spam filter, so you can’t count on your phone to catch them for you.

2. The link opens a fake Netflix login page built to match the real one

Tapping the link redirects you to a page that closely mirrors Netflix’s actual login screen: the red logo, the dark header, floating-label input fields, and a Google reCAPTCHA badge at the bottom. The address bar shows a domain like “netfilx-membership,” with the letters subtly swapped, a difference that’s easy to miss on a phone screen.

You’re asked to enter your email or phone number, then your password. The page looks and feels exactly like signing into Netflix.

3. After your password, the site collects your credit card and billing details

Once you enter your login credentials, the site moves to a “set up your card” page that asks for your full card number, expiration date, CVV, and billing address. A final step labeled “complete your payment” may ask for your card details again or present a PayPal payment button.

After you finish, the site either redirects you to the real Netflix homepage or shows a fake “card declined” error that prompts you to re-enter your details with a different card. The scammers now have your Netflix login, one or more payment cards, and your personal information.

Red flags

You’ve got this. Here’s what to watch for:

1. An unsolicited billing text from Netflix: Netflix sends payment notifications through the app and email, not SMS.
   
   
2. A deadline to act within 24 hours: Real billing issues don’t threaten immediate suspension with a countdown.
   
   
3. A misspelled domain in the address bar: After tapping, check the browser address bar. Netflix only uses netflix.com. Look for swapped letters or extra words in the domain.
   
   
4. A login page that asks for your credit card right after your password: Netflix does not ask for payment details through a link in a text.
   
   
5. A “card declined” error after you entered valid details: This is a technique to harvest a second card number.
   
   
6. No matching alert in the Netflix app: If Netflix actually had a billing issue, you’d see it when you open the app directly.

How to stay safe

1. Don’t tap links in billing texts. Open the Netflix app directly or type netflix.com in your browser to check your account status.
   
   
2. Check the URL before entering anything. Netflix only uses netflix.com. If the domain spells “netflix” differently or adds extra words, it’s fake.
   
   
3. Use a unique password for Netflix. If your Netflix password is reused on other accounts, a stolen login gives scammers access to those too. For more on building strong, unique passwords, see The Dos & Don’ts of Password Management.
   
   
4. Report the text. Forward suspicious texts to 7726 (SPAM). File a report with the relevant authority in your country, such as the FTC (US), Report Fraud (UK), or Scamwatch (Australia). Reporting helps authorities track these campaigns and warn others.
   
   
5. Use Trend Micro ScamCheck. It can flag suspicious links and texts before you tap them.

You’ve got this

These scams work because Netflix is part of everyday life, and a billing notice feels routine. Even careful people can be caught off guard when a message looks like something they’d normally expect. Now that you know what the fake texts look like and where the real Netflix will never send you, you’re already ahead. Take your time, check the URL, and trust your instincts.