The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Spotify email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Spotify email says your payment failed, then asks for your card, your password or a payment through Western Union.
Spotify’s page on suspicious emails lists what it will never ask for by email. The email below is invented, and each number is one of the signs.
Example
Dear member,
We could not take your last payment, and your Premium plan ends today. Reply with your card number and password to keep it.
Or pay the $12 balance through Western Union and send us the receipt.
Open the attached form to see your bill.
The button says spotify.com/account
The sender's address does not end in @spotify.com.
Spotify says an email is suspicious if the sender email doesn't end in "@spotify.com", or if you're simply not sure about it.
A request for your card number and password.
Spotify says it will never ask for personal information over email, such as your payment info, your password, or your Social Security or tax identification number.
A request to pay through Western Union.
Spotify says it will never request payments via a third party, for example Western Union.
An attached form to open.
Spotify says it will never ask you to download anything from its emails, and not to respond to, click any links in, or download anything in a suspicious email.
A button that says spotify.com and goes somewhere else.
The label on a button is not the address it opens. Spotify says not to click any links in a suspicious email.
From Spotify Support: Is this Spotify email legit?, read 9 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “Spotify” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Spotify’s support pages are at support.spotify.com, and the owner of that address is spotify.com. Spotify says an email is suspicious if the sender doesn’t end in @spotify.com.
Read the domain from the right
support.spotify.com
From SpotifyOwned by spotify.com. This is the address of Spotify's own support pages, and Spotify says a real sender's address ends in @spotify.com.
spotify.com.account-billing.example
Not from SpotifyOwned by account-billing.example. spotify.com is only a label in front of it.
spotify-premium-renewal.example
Not from SpotifyOwned by spotify-premium-renewal.example. The name has Spotify in it, but the owner is someone else and the address does not end in @spotify.com.
From Spotify Support: Is this Spotify email legit?, read 9 November 2026.
Spotify says it will never ask for your payment info, your password or a payment through a third party.
Spotify’s page gives a short list of what it will not do by email, and says which emails it does send. A fake payment notice breaks at least one of them.
| Question | What Spotify says | What a fake payment notice does |
|---|---|---|
| Will Spotify ask for my payment info or password by email? | What Spotify saysSpotify says it will never ask for personal information over email, such as your payment info, your password, or your Social Security or tax identification number. | What a fake payment notice doesAsks you to reply with your card number and password. |
| Will Spotify ask me to pay through a third party? | What Spotify saysSpotify says it will never request payments via a third party, for example Western Union. | What a fake payment notice doesAsks you to send a payment by Western Union. |
| Will Spotify ask me to download something? | What Spotify saysSpotify says it will never ask you to download anything from its emails. | What a fake payment notice doesAsks you to open an attached form. |
| Which sender address is a warning sign? | What Spotify saysSpotify says an email is suspicious if the sender email doesn't end in "@spotify.com", or if you're simply not sure about it. | What a fake payment notice doesA sender that has Spotify in its name and ends in someone else's domain. |
| Which Spotify emails are real? | What Spotify saysSpotify says it sends emails about account activity to help keep your account safe, including new logins and new Family or Duo members, and that for security you can't turn these emails off. | What a fake payment notice doesCopies the look of a real notice, then asks for details. |
From Spotify Support: Is this Spotify email legit?, read 9 November 2026.
Spotify says to forward the email to spoof@spotify.com, delete it and reset your password if you responded.
Spotify gives one address for a suspicious email, and says what to do if you already clicked, replied or downloaded something.
How to report a fake Spotify email
- Forward the email
To spoof@spotify.com.
Spotify says to forward a suspicious email to spoof@spotify.com.
- Delete it
Delete the email.
Spotify says not to respond to, click any links in, or download anything in the email, and to delete it after you report it.
- Reset if you responded
Reset your password.
Spotify says to reset your password and change it on any other sites where you use the same password.
From Spotify Support: Is this Spotify email legit?, read 9 November 2026.
Five steps tell you whether a Spotify email is real without clicking anything.
- Do not respond, and leave every link and attachment alone. Spotify says not to respond to, click any links in, or download anything in a suspicious email.
- Read the sender’s actual address from the right, as in the picture above. Spotify says a sender that doesn’t end in @spotify.com is suspicious.
- Check your plan by opening the Spotify app or site yourself. Spotify says it will never ask for payment info or a password by email, and the FTC says to contact a company using a phone number or website you know is real, not the information in the email.
- Paste the email into the checker at the top of this page for a second read.
- Forward the email to spoof@spotify.com, then delete it. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from Spotify Support: Is this Spotify email legit?, read 9 November 2026.
Steps from FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 9 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 9 November 2026.
If you responded to a fake Spotify email, Spotify says to reset your password and contact your bank if you gave financial details.
Spotify says that if you already responded, clicked a link or downloaded something, you should reset your password, change it on any other sites where you use the same password, and contact your bank if you think your financial details have been compromised. Its page on a hacked account adds that you should reset the password using a link opened in a private or incognito window, choose Sign out everywhere on your account page, and remove access for connected third-party apps.
What to do depends on what you did
You only read it.
Forward it to spoof@spotify.com, then delete it.
You clicked, replied or downloaded something.
Reset your password and change it on any other site where you use the same one. Spotify also says to choose Sign out everywhere on your account page and to remove access for connected third-party apps.
You gave card or bank details.
Contact your bank, then follow the steps at IdentityTheft.gov for what you shared.
From Spotify Support: Is this Spotify email legit?, read 9 November 2026.
From Spotify Support: Think your account's been hacked?, read 9 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 9 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 9 November 2026.
The same checks work on other subscription emails.
A billing notice can borrow the name of any service. The guide to fake Netflix emails covers a request for your card number, and the guide to fake Apple emails covers a receipt for something you never bought. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real Spotify email from a fake one?
Spotify says an email is suspicious if the sender's address doesn't end in @spotify.com, or if you're simply not sure about it. It says not to respond to it, click any links or download anything in it.
What does Spotify say it will never ask for?
Spotify says it will never ask for personal information over email, such as your payment info, your password, or your Social Security or tax identification number. It also says it will never request payments through a third party (for example, Western Union) or ask you to download anything from its emails.
Which Spotify emails are real?
Spotify says it sends emails about account activity to help keep your account safe, including new logins and new Family or Duo members. It says you can't turn these emails off, and that if you see activity you don't recognize you should go to its account takeover help.
Where do I report a fake Spotify email?
Spotify says to forward the email to spoof@spotify.com, then delete it. In Gmail you can also choose More next to Reply, then Report phishing.
What if I already clicked, replied or downloaded something?
Spotify says to reset your password, change your password on any other sites where you use the same password, and contact your bank if you think your financial details have been compromised.
How do I know if my Spotify account was taken over?
Spotify lists these signs: your email address changing, playlists added or lost, music playing without your control, your subscription changing, an unrecognized Facebook connecting to your account, emails about logins you don't recognize, or your password not working anymore. It says to reset your password and open the reset link in a private or incognito window, choose Sign out everywhere on your account page, and remove access for connected third-party apps.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.