[Subscription][Security] Re-enter Payment Details to Upgrade to Family

[honda234]

Once hackers get access to my Spotify account, they will change my regular Premium subscription to Premium For Family and add strangers to my plan.

I will be charged $5 extra each month!

Spotify does NOT require to enter my credit card number to change the subscription type, which leaves the risk to users.

It means hackers NOT ONLY have stolen Spotify accounts, but also have stolen stored payment method to pay for family plans.

But in France and the UK, Spotify requires to enter the credit card number to change the subscription type to a Family plan. (free Google home mini was the reason why Spotify start asking for re-enter credit card info, but the offer has ended, Spotify no longer ask for re-enter card info...)

Idea: Please ask users to re-enter card number when changing regular Premium to a Family plan. Just like what Spotify did in US/UK/FR markets when free Google Home minis were giving to family owners for free. So hacked users won't be charged unauthorized money when hackers upgrading their plans to the family plan using stored payment method.

[candacetaylor07]

[i_u7-rn15p9i]

Spotify account is very cheap in dark web. Probably this is why

[anpen24]

My account was accessed by stranger, but what makes me wonder is that my password combination includes numbers and letters and symbols.

[kris23lzp]

i definitely agree with this post.

[937527756]

It is hard to believe after so many days this is still an active idea after so many feedbacks.

"Good job" , Spotify

[caiyue115]

Spotify keeps indulging hackers from the start.

Do something, please

[qjiiie0806]

I don't want hate talks, but security is the most important factor of major online services like Spotify.

[G_Loc]

Spotify is still having security issues?  Shocking.  I can't believe there's still no option to use 2FA or even anything in place to detect suspicious logins.

Perhaps I should finally finish working on my site and put up the massive DB of compromised accounts so that those who think they have been affected can search for their e-mail address.

[shanwright]

this happened to me too! totally not acceptable 

[Goodman]

Updated on 2019-11-27

Hi everyone.

As this idea was posted a while ago now, we’d like to provide an update.

While, for obvious reasons, we can’t go into too much detail, in the last six months we have introduced additional improvements. This includes, for example, a change in how email notifications and invites work.

Additionally, we continue to look into more and better ways to provide our users with the best possible, and safe experience.

When ideas are posted to the community the ideal outcome is to have it transition into the Implemented status. When we mark an idea as Implemented we will provide details about what we’ve done.

The very nature of this idea, however, would preclude us from doing so. 

In other words: this is important to us, we would like everyone who wants to, to keep voting on this idea; as you know votes show us how important something could be.

In conclusion: for all intents and purposes we have to change this idea’s status to Not Right Now.

If you'd like further information about protecting your account please visit our Support Site.