BRAND IMPERSONATION

Crunchyroll "membership expired" scam email: how to spot the fake suspension notice

A Crunchyroll email about a "suspended account" or a "failed membership payment" with a link is one of the most common phishing lures aimed at anime fans in 2026.

SB

SafeBrowz Threat Research Security ResearchJune 15, 20268 min read

What the Crunchyroll account scam looks like

The email arrives with the orange Crunchyroll logo and "Hime" branding lifted from the real site, an urgent subject line ("Your Crunchyroll membership has expired" or "Action required: account suspended"), and a button labeled "Renew membership" or "Update payment." The body text is short and built to push you to click before you think:

Your Crunchyroll Premium membership could not be renewed because your payment failed. Update your billing within 24 hours or your account and watch list will be suspended.

The button leads to a counterfeit Crunchyroll sign-in page that captures your email and password, then a second page asking for your card number, expiration, CVV, and billing zip. Within minutes the attacker has your login plus a working card. Because Crunchyroll's audience skews young and many fans reuse the same password across game accounts, Discord, and email, a single stolen Crunchyroll credential is often the start of a wider takeover.

Real Crunchyroll payment emails exist, but they never ask you to "verify" your card through an email link. They ask you to open the app or sign in directly at crunchyroll.com and manage billing inside your account. Every fake version links to a third-party domain instead.

How the Crunchyroll phishing scam works, step by step

• The hook. An email or text claims your Premium membership "could not be renewed," your "payment failed," or your "account is suspended." A countdown of 24 to 48 hours adds pressure.
• The fake link. The button points to a lookalike domain that is never crunchyroll.com - something like crunchyroll-renew[.]top or crunchyroll-billing[.]com.
• The cloned login. The page is a pixel-accurate copy of the real Crunchyroll sign-in screen. You enter your email and password, and they are sent straight to the attacker.
• The card harvest. A follow-up "your payment method needs updating" screen asks for full card details. Crunchyroll never collects card data this way over email.
• The cash-out. The login is tested against other services, and the card is charged or resold, often within a day.

The tells: how to spot it in seconds

• 1. The link is never crunchyroll.com. The real domain is crunchyroll.com. Scam links use lookalikes such as crunchyroll-renew[.]top, crunchyroll-billing[.]com, or a subdomain-chain trick like crunchyroll.com.account[.]xyz. The real domain is the part immediately before the first single slash after https://. In crunchyroll.com.account[.]xyz the real domain is account.xyz, not Crunchyroll.
• 2. Crunchyroll never asks for card details by email. Any message asking you to enter your card number, CVV, or a "reactivation fee" through an email link is a scam. Billing changes happen only inside your account after a normal sign-in.
• 3. Urgency means scam. "Within 24 hours" or "your account will be permanently deleted" is the single most reliable scam indicator. Real services give you time and do not threaten instant deletion of your watch list.
• 4. Generic greeting. "Dear valued member" or "Hello Crunchyroll user" is a red flag. Legitimate account emails normally use the name on the account.
• 5. Sender address is off. Display names can read "Crunchyroll Support" while the actual address ends in something like @crunchyroll-billing.com. Check the address after the @, not the friendly name.
• 6. A free account that "expired." If you only ever used the free, ad-supported tier, there is no paid membership to expire or suspend. Any "your membership payment failed" email to a free-only account is impossible and therefore fake.

What to do if you already clicked or entered details

Speed matters. Stolen streaming credentials and card data are often used within 24 to 72 hours. Move now, in this order:

1. Change your Crunchyroll password. Open the app or sign in directly at crunchyroll.com and change your password to a long, unique one you have not reused anywhere.
2. Enable two-factor authentication (2FA). Turn on 2FA in your Crunchyroll account security settings so a stolen password alone cannot get back in.
3. Lock or replace your card. If you entered card details, lock the card in your bank app and order a replacement with a new number. Most banks have a one-tap "lock card" feature.
4. Change reused passwords. If your Crunchyroll password is used on your email, Discord, game accounts, or a streaming service, change those too. Credential-stuffing tools try stolen passwords against other sites within hours.
5. Watch your statements. Check your bank statement daily for two weeks. Card fraud often starts with small test charges before larger ones.

How to check safely: open Crunchyroll yourself

The safest verification never touches the email at all. Follow these five steps:

1. Do not click the email button. Close the email and switch to the Crunchyroll app or a fresh browser tab.
2. Open crunchyroll.com yourself. Type the address manually or open the app you already trust on your phone or TV. Do not search "Crunchyroll" during a phishing wave; sponsored results sometimes hide typosquats.
3. Check your Account and Membership status. Your real membership tier, renewal date, and any genuine payment issue all appear here. No warning in your account means there is no problem, regardless of what the email claimed.
4. Change your password and enable 2FA from the account security settings if anything looks off, or as a precaution.
5. Lock or replace your card if you entered card details anywhere outside the official site or app.

Why Crunchyroll is a frequent phishing target

Crunchyroll has a large, young, highly engaged anime audience, and a meaningful share of those users pay for the Premium tier to skip ads and watch new episodes early. That combination - a big subscriber base plus an audience that is younger and more likely to reuse passwords across game and chat accounts - makes Crunchyroll an attractive brand for attackers to impersonate. The "your favorite show is about to be cut off" angle also lands harder than a generic billing notice, because fans do not want to miss a simulcast.

How browser-layer defense catches this earlier

Email filters miss most of these messages because attackers buy fresh lookalike domains faster than blocklists update. The defense that consistently works is at the click destination. When you land on the fake Crunchyroll billing page, a browser-layer scanner can recognize "Crunchyroll branding on a non-crunchyroll.com domain" and block the page before any input field is interactive.

SafeBrowz is a free Chrome, Firefox, and Edge extension that scans every URL before the page renders. Install SafeBrowz free for browser-layer defense across every brand you log into.

How SafeBrowz blocks this threat

SafeBrowz, which launched in 2026, runs a 3-layer detection architecture: Local + APIs + AI.

• Layer 1 - Local detection. SafeBrowz flags the Crunchyroll name on a non-official domain content-free, meaning it does not need to read the page to know the domain is wrong. It also catches the subdomain-chain trick like crunchyroll.com.verify[.]xyz, where the brand name is placed before the real domain to fool the eye. 60+ URL patterns and 550+ brand signatures run directly in the extension before the page renders.
• Layer 2 - API checks. SafeBrowz aggregates Google Safe Browsing, PhishTank, URLhaus, and other feeds for known malicious domains.
• Layer 3 - AI deep scan (Premium). AI content analysis catches a cloned Crunchyroll login page even if it is pixel-perfect, by judging the page itself rather than relying on a blocklist. It works across 100+ languages.

Detection signatures come from threat-intelligence research and brand database analysis, not from user browsing data. SafeBrowz does not collect your browsing history, and per-user URL history is never stored.

Install SafeBrowz free

Add the browser extension that runs every check in this article automatically, on every page, before it renders. Free forever.

Add to Chrome Add to Firefox Add to Edge

Frequently asked questions

Is the "Crunchyroll membership expired" email real?

Almost never. A Crunchyroll email about a suspended account or a failed membership payment with a link is almost certainly a scam. The real Crunchyroll only uses crunchyroll.com and never asks for card details by email. The safe move is to ignore the email, open the Crunchyroll app or type crunchyroll.com yourself, and check your membership status directly.

Does Crunchyroll ask for card details by email?

No. Crunchyroll never asks you to enter your card number, CVV, or a reactivation fee through an email link. All billing changes happen inside your account after you sign in on the official site or app. Any message asking for card details by email is a phishing attempt, full stop.

How do I tell the real Crunchyroll link from a fake one?

The real domain is crunchyroll.com, and it must be the part immediately before the first single slash after https://. Scam links use lookalikes such as crunchyroll-renew dot top, crunchyroll-billing dot com, or a subdomain chain like crunchyroll.com.account dot xyz, where the real domain is actually account.xyz. If the part right before the first slash is not exactly crunchyroll.com, it is not Crunchyroll.

I clicked the link but did not enter anything. Am I safe?

Almost certainly yes. Most Crunchyroll phishing pages are simple HTML forms, not malware, so just visiting does not install anything on a modern browser. Close the tab, do not return to the link, and change your password as a precaution. If you downloaded a file from the page, run a virus scan with your built-in antivirus.

I entered my password and card. What should I do first?

Move fast. Change your Crunchyroll password from the official app or site, enable two-factor authentication, then lock or replace the card you entered. Change the same password anywhere else you reused it, and watch your bank statement daily for two weeks. The card-and-credential bundle is the valuable part to attackers, so cutting off both quickly limits the damage.

Can a free Crunchyroll account really be "suspended for non-payment"?

No. If you only ever used the free, ad-supported tier, there is no paid membership to lapse, so there is nothing to suspend for non-payment. Any email claiming your free Crunchyroll account was suspended because a payment failed is impossible and is a clear sign of phishing.

Related reading

• Peacock account locked email scam: how to spot the fake suspension notice - the closest streaming variant
• Paramount+ subscription scam email: how to spot the fake billing notice - same template, different brand
• "Spotify account suspended" email scam - subscription phishing applied to music streaming
• All SafeBrowz security articles

Bottom line: The Crunchyroll membership scam keeps working because the email looks normal and the fear of missing the next episode hits before you verify the sender. The defense has not changed. Do not click. Open the Crunchyroll app or type crunchyroll.com yourself, check your membership status, and add a browser-layer scanner like SafeBrowz for every streaming brand the same template targets next.