{"success":true,"data":{"id":"fake-youtube-premium-music-subscription-billing-phish","label":"Fake YouTube Premium or YouTube Music subscription suspended — consumer ad-free subscription payment failed, YouTube Music access revoked, ad-free playback and background play no longer active due to billing failure phishing","description":"Phishing emails impersonating YouTube or Google claiming the YouTube Premium or YouTube Music subscription has been suspended, ad-free video access has been revoked, or YouTube Music access is no longer active due to a billing failure — directing victims to update payment through a credential-harvesting portal. A distinct consumer streaming attack category not covered by any existing signal (the existing TikTok/YouTube signal targets creator account suspension for monetization violations, not consumer subscription billing failure). Key facts: (1) YouTube Premium has 100M+ subscribers globally at $13.99/month or $139.99/year — YouTube Premium bundles ad-free video playback, background play, offline downloads, and YouTube Music Premium; a 'YouTube Premium subscription payment failed, ad-free access suspended' email creates urgency for the 100M subscribers who have paid specifically to eliminate the ad experience they find disruptive; (2) YouTube Music Premium (bundled with YouTube Premium) is a competitor to Spotify and Apple Music — 'your YouTube Music Premium subscription has been cancelled, ad-free music streaming no longer available' taps into music listener urgency that mirrors Spotify billing phish but is genuinely distinct because the service is Google-branded; (3) The credential value is exceptionally high: YouTube Premium login credentials are Google Account credentials — capturing the YouTube Premium login gives attackers full Google Account access including Gmail, Google Drive, Google Photos, Google Pay, and all connected apps; attackers acquire a complete Google account for the cost of a plausible billing failure email; (4) The Google billing infrastructure creates a specific attack surface: Google sends legitimate billing notifications from pay.google.com and payments.google.com, and attackers can clone the exact format including the partial card number, renewal date, and plan name; users who see a familiar Google Payments format with their YouTube Premium plan details assume the email is legitimate; (5) The 'background play disabled' hook is uniquely specific to YouTube Premium and creates urgency for commuters, podcast listeners, and gym users who depend on audio playback with the screen off — 'your background play has been disabled' is not a generic streaming hook and identifies the phish as specifically targeting YouTube Premium subscribers; (6) Annual subscription timing: YouTube Premium offers annual plans that auto-renew — a 'your annual YouTube Premium subscription renewal has failed' email arriving near the renewal anniversary is indistinguishable in format from the legitimate renewal notification. Warning signs: sender not youtube.com or google.com; genuine YouTube Premium billing at youtube.com/paid_memberships; never sign in to YouTube Premium from a link in a billing failure email.","tier":"danger","category":"phishing","isThin":false}}