What your login is worth to a fraudster
Streaming accounts are a popular target because they are easy to resell and often give access to a payment method. A fraudster who gets your login can:
- resell access to your account, or use it on many devices until the service blocks it;
- change the contact address and the password to lock you out;
- reuse the same pair of username and password on other sites (email, bank, online shops): this is the attack known as credential stuffing, which exploits reused passwords;
- use the saved bank card to sign up for options or buy content.
Xtream Codes accounts pose a particular problem: the server address, username and password often appear in plain text in the playlist address, for example http://server.example:8080/get.php?username=john&password=abc123&type=m3u_plus. Sharing that address, posting a screenshot of it on a forum or sending it by messaging app amounts to giving away your credentials. Our page on Xtream and M3U formats shows how this information is structured.
Recognizing phishing
Phishing consists of getting you to enter your login or bank details yourself on a fake page. The bait message arrives by e-mail, text message, instant messaging or social network, and imitates the look of a well-known service.
The most common scenarios
- The fake "payment problem": "Your subscription is suspended, update your payment method within 24 hours."
- The fake renewal: "Your subscription expires today, renew it so you do not lose your channels", with a link to a payment page.
- The fake refund: "You were charged twice, click to be refunded." The page then asks for your card number "to credit the amount".
- The fake exceptional offer: a free year, an unbeatable price, valid "for a few hours only".
- The fake customer service: an account on a social network that replies to your public complaint and invites you to continue in a private message.
The clues that give the trap away
| Clue | What to check |
|---|---|
| Urgency and threats | A real service does not cut a subscription within hours without a prior reminder |
| Sender address | Approximate domain name, added letters, a domain unrelated to the service |
| Link in the message | Hover over it or long-press: the real address is shown before you open it |
| Unusual request | Code received by text, security code, bank validation code: no service asks for these by message |
| Generic greeting | "Dear customer" instead of your name, mistakes, sloppy layout |
The most effective rule is simple: never follow a link you received in order to log in or pay. Open the official app yourself or type the service's address in your browser. If a real problem exists, it will show up in your customer account.
Payments to avoid
How a seller asks you to pay says a lot about how serious they are. Some payment methods are irreversible: once the money is gone, neither your bank nor anyone else can get it back.
- Gift cards and prepaid vouchers: no legitimate merchant demands payment in gift card codes. It is one of the most reliable signs of a scam.
- Cryptocurrencies: transactions are final and the recipient's identity is hard to establish.
- Bank transfer to an individual, especially to an account abroad: no protection if the goods are never delivered.
- "Friends and family" payments on online payment services: this option excludes the buyer protection provided for purchases.
By contrast, a bank card on an identified site, with strong authentication (approval in your bank's app), offers ways to dispute a charge. For subscriptions, prefer paying through app stores or directly on the service's official website, which let you easily view and cancel the subscription. A virtual card, offered by many banks, also limits exposure of your real card number.
These untraceable payment methods are precisely the ones demanded by sellers of illicit offers: our article Is IPTV legal or illegal? details the other warning signs.
Managing your passwords well
One unique password per service
The main danger is not a password that is too short, but a reused password. If a poorly protected site has its database stolen, all your accounts using the same password become vulnerable. Use a long passphrase (four or five unrelated words) or a random string of at least twelve characters, different for each service.
A password manager
Nobody can remember dozens of unique passwords. A password manager generates them, stores them encrypted and fills them in automatically on the right site, which also protects against phishing: it will not offer your login on a fake domain. Android, iOS and the main browsers include one.
Two-factor authentication
Turn on two-step verification everywhere it is offered, starting with your email account: it is what lets you reset all your other passwords. An authenticator app or a security key is safer than a code received by text message, but a text message is still better than nothing.
On shared devices
- On a family TV or computer, sign out of services before reselling or lending the device, then reset it.
- In services that allow it, regularly check the list of connected devices and remove those you do not recognize.
- Do not send your logins by message, even to a relative: conversations are stored and synced across many devices.
Account sharing: what to know
Most streaming services limit the number of simultaneous screens and, increasingly, reserve a subscription for people in the same household. Sharing your account beyond what the terms of use allow can lead to extra charges or suspension.
For Xtream Codes accounts, the number of simultaneous connections is set by the provider. If a third party uses your login, you will see messages about exceeding the number of connections or unexplained dropouts. In that case, ask your provider to change your password. On the player side, enter your credentials directly on each device rather than passing around the full playlist address by message; in AICKO IPTV, a single account then syncs your favorites and playback progress between screens.
What to do in case of fraud
If you gave out your information or noticed a suspicious transaction, act fast and in this order. The steps below are the French ones (France); in other countries, start with your bank and your national consumer and police authorities.
- Block your card by calling your bank or through its app. In France, the interbank card-blocking service can be reached at 0 892 705 705 at any hour.
- Dispute the unauthorized transactions with your bank. For a payment you did not authorize, the bank should in principle refund you quickly; the dispute must be made without delay, and at the latest within thirteen months of the debit.
- Report the card fraud on the official Perceval platform, accessible from service-public.fr, if purchases were made with your card number without you having lost the card.
- Change your passwords, starting with your email, then every account using the same password. Turn on two-factor authentication.
- File a complaint. For online scams in France, a complaint can be filed on the Internet through the Interior Ministry's Thésée platform.
- Report the message or site: a fraudulent text message can be forwarded free to 33700 (France), and illegal online content reported on the official platform Pharos (France).
The French national scheme Cybermalveillance.gouv.fr offers an online diagnosis, practical guides for each type of scam and referral to professionals. The procedures for filing complaints and reports are also detailed on service-public.fr (France).
Mistakes that make things worse
- Paying a second time to "unlock" a refund promised by the fraudster.
- Answering fake recovery services that promise to get your money back for an up-front fee.
- Waiting: the later you block the card, the more time the fraudster has to use it.
In summary
- An Xtream playlist address often contains your credentials in plain text: do not share it.
- Never follow a link you received to log in or pay: go through the official app or website.
- Refuse gift cards, cryptocurrencies and transfers to individuals.
- A unique password per service, a manager and two-factor authentication.
- In case of fraud: block the card, dispute, change passwords, file a complaint and report.
Frequently asked questions
I clicked a link without entering anything: am I at risk?
The risk is low if you entered no information and installed nothing. Close the page, update your browser and system, and stay alert to the following messages, which may be more targeted.
Will my bank refund me?
For a transaction you did not authorize, the bank should in principle refund you, except in cases of gross negligence on your part, for example if you yourself shared a validation code. Dispute it without waiting and keep the evidence.
How can I tell if someone is using my account?
Check the viewing history and the list of connected devices in your customer account. Connections refused for exceeding the number of screens, or programs you did not watch, are telltale signs.
Where can I report a fraudulent site or message?
In France, forward fraudulent text messages to 33700, report illegal content on Pharos and visit Cybermalveillance.gouv.fr for guidance. If you suffered a loss, file a complaint, online through Thésée for Internet scams. In other countries, contact your national authorities.
