I have a .com domain that I have been using for many years where a catch-all e-mail is configured. Since some time someone was creating fake Spotify accounts using my domain.

I don't have configuration error, no malware or anything like that and I contacted my e-mail service provider Zoho to check this out and they are positive that the e-mails I'm receiving from Spotify are authentic and there's no breach on their part.

I also contacted Spotify and they are absolutely sure that it's not possible to create accounts without confirming e-mails and can't do anything about it.

I have no idea how these accounts are created without me confirming the e-mail address but they are obviously fake, like a common name and numbers @mydomain .

So I used the forgot my password option to log in to check out what those accounts are doing and they were listening some obscure songs.

At some point, the person running the scheme decided to move to another domain as I received e-mail address change mails, they moved to some random .xyz domains.

Still keep receiving "3-months for free" promo from Spotify for those fake accounts.

https://dropovercl.s3.amazonaws.com/208ea6fc-821c-4d51-8c46-...

So yep, I'm sure there are many scams going on in Spotify.