Your inbox is probably full of year-end roundups. Some are real. Most of them are absolutely bollocks.
Scammers have worked out that December is basically open season on our attention spans. We’re expecting these “year in review” emails from Spotify, YouTube, Instagram, and whatever other platforms we’ve wasted our lives on this year. We’re primed to click. We’re sentimental. We’re distracted by Christmas shopping and office party hangovers. Perfect conditions for digital theft.
We’re predictable.
How the Scam Actually Works
The trick is painfully simple. You get an email with a subject line like “Your Year in Review” from a platform you’ve maybe heard of (probably avoided) but definitely never used. Perhaps it’s a productivity app. Perhaps it’s some niche streaming service. You might pause for half a second thinking “Did I sign up for that?” but curiosity wins and you click anyway.
That’s it.
Job done.
You’ve either confirmed your email is active (prepare for a flood of spam) or you’ve just handed over login credentials on a fake landing page that looks exactly like the real thing.
The Numbers Don’t Lie
Between January and May this year alone, phishing attacks hit 12.6 million emails. That’s just five months. Text scams jumped 250% around major shopping events. Email scams increased 160% in some categories.
These aren’t amateur hour operations anymore.
Scammers are using AI to personalise messages at speed and scale.
A quarter of scam calls in the UK now use AI voice manipulation. The sophistication has gone from laughable to genuinely dangerous in about three years.
Why This Particular Scam Works So Well
The “year in review” angle is bloody genius from a social engineering perspective. Spotify Wrapped has trained us to drop everything and click the moment we see that type of email.
It’s performative, it’s shareable, it’s time-sensitive.
You don’t want to miss out. Scammers know this. They’re banking on you clicking first and thinking second.
And it works because we’re exhausted. December is already chaos. We’re juggling deadlines, family obligations, financial stress, and trying to remember which relatives we actually bought presents for.
Our critical thinking is on life support. When that email lands promising a neat little summary of our year, we want it to be real. We want that dopamine hit of seeing our habits quantified and packaged. Scammers exploit that want.
What You Should Actually Do
Check the sender’s email address properly. Not the display name that says “Spotify” or “YouTube” but the actual email address. If it’s coming from randomstring847[@]gmail.com or anything that doesn’t match the official domain, delete it!
- Don’t click unsubscribe.
- Don’t click to “view your report.”
- Just bin it.
If you receive a year in review email from a platform you don’t recognise or haven’t used, ask yourself why they’d have your email in the first place. The answer is usually they don’t. Delete it.
Legitimate companies won’t ask for passwords, payment details, or personal information via email. They especially won’t create urgency around a bloody year-end summary. If Spotify actually cared whether you saw your Wrapped stats within the next hour, they’d have bigger problems than you ignoring an email.
We’ve Made This Too Easy
We’ve built this culture of immediate engagement with year-end content and scammers have simply walked through the door we left open. They’re not clever. We’re just predictable. And tired.
Stop clicking emails from services you don’t use. Stop assuming every “year in review” is legitimate just because it lands in December. Stop treating your inbox like a lucky dip where the worst that can happen is you waste 30 seconds.
The worst that can happen is identity theft, financial fraud, or your email becoming a spam distribution centre. That’s not hyperbole. That’s the reality of clicking first and questioning later.
Your actual year in review? It’ll be on the platform itself when you log in through your bookmarked URL or app. Not in some random email that just happened to land during peak scam season.