Netflix's account-sharing test relies on a verification code sent by email or text, and that is easy to get around: the person sharing the account can simply pass the code along. The deeper problem is that usernames and passwords can be shared at all. As long as they exist, so will account sharing.

Netflix has had enough of your friend mooching off your account. In March 2021, the streaming company began testing a way to limit people outside the account owner's home from using the same login. Viewers flagged as possible unauthorized users were asked to verify with a code sent to the account owner by email or text, or to put it off and verify later. It is a form of two-factor authentication, and it makes sharing more of a hassle.

Update: Netflix rolled this idea out across the U.S. in May 2023. Accounts are now limited to one household, and account owners on eligible plans in many countries can add paid extra members outside it (at launch, $7.99 a month). Netflix's Help Center lists the current household rules and pricing. The 2021 test described below was an early version of that approach.

How Common Is Account Sharing?

The behavior Netflix is trying to limit is widespread. In a survey of 401 U.S. adults taken in April 2020, The Manifest found that most streaming subscribers share their accounts, and that a large part of that sharing crosses household lines.

Of that 37%, 25% shared with family members outside their home and 12% with friends or acquaintances. That out-of-household group is the one that represents potential lost revenue for the service.

Why a Verification Code Is a Low Hurdle

Netflix seems to be using two-factor authentication as a deterrent to credential sharing, but the strategy isn't bulletproof. The code goes to the account owner, so a borrower only has to ask for it. And a Netflix login is an email and a password. When people reuse that combination for the email account itself, a borrower can open the inbox, read the code, and verify without asking anyone.

A later real-world example shows the same weakness. In the 2022 Uber breach, an attacker got past MFA by persuading an employee to approve it. Any check that a person can approve or hand over is only as strong as that person's judgment.

On the business side, even when the account owner agrees to the sharing, the ability to willingly pass along a login costs the company revenue, which is exactly what subscription businesses are trying to prevent. Verification prompts feel more like a low hurdle than a permanent fix for users siphoning off potential revenue.

This Isn't Only a Netflix Problem

Netflix's move may kick off a trend. Streaming companies like Hulu and Disney+ face the same exploit, and so does any subscription service that can be gamed through credential sharing, from music streaming to digital news outlets to VPNs, regardless of the business's size.

The Root Cause: Credentials Can Be Shared

The issue lies in login credentials, which are shareable no matter how many hoops customers must jump through. It is the same weakness behind many account takeovers, as we covered in Passwords Are Their Own Worst Enemy. And access isn't always handed over willingly: guessing a friend's login is more common than most people think.

As long as usernames and passwords are in use, subscription siphoning through credential sharing will still exist.

Remove the Username and Password

The solution is right in front of us. If companies drop usernames and passwords, there is no credential to copy and send along, and access is tied to a device the paying customer controls.

Usernameless and passwordless login doesn't require typical credentials at all. With a personalized key, such as a user's smartphone paired with a QR code, it becomes much more difficult for multiple people to share one account. No approach can stop someone from physically handing over their phone, but a login tied to a specific device can't be texted or pasted to a friend the way a password or a code can.

There is a wide range of products on the market, and WWPass, which uses the WWPass Key on a phone, is a strong, practical option.

FAQ

Why is Netflix cracking down on account sharing?
Netflix's terms limit the service to personal, non-commercial use within a household, and sharing outside it means people watch without paying. Netflix has said the practice affects its ability to invest in new TV and films, and it began rolling out paid sharing in the U.S. in May 2023.

How did Netflix's 2021 account-sharing test work?
Some viewers who appeared to be outside the account owner's household saw a prompt saying they would need their own account. They could verify with a code sent to the account owner by email or text, skip and verify later, or sign up for their own account.

Can a verification code stop password sharing?
Not reliably. Because the code goes to the account owner, a borrower can simply ask for it, and a reused email login can let them read it directly. A code adds a step without removing the shareable credential.

What is an alternative to passwords for preventing credential sharing?
Usernameless and passwordless login tied to a device, such as a smartphone paired with a QR code. There is no username or password to copy and send, so sharing access takes far more effort than forwarding a password.

Does Netflix still allow account sharing?
Only within a household, unless the account owner adds a paid extra member. Netflix's Help Center defines a household as the devices connected to the internet at the main place you watch, and extra members are available on eligible plans in many countries. Check the Help Center for current terms.

The Bottom Line

Verification codes make account sharing a little less convenient. Removing the shareable credential is what changes the behavior. Whatever businesses choose, a simpler login that leaves no credential to share protects revenue better than adding more steps to the old one.