T-Mobile Rewards Scam Puts Users at Risk

A large phishing campaign is impersonating T-Mobile with text messages warning recipients that their accumulated rewards points are about to expire, according to Malwarebytes.

A large phishing campaign impersonating T-Mobile, sending fake texts claiming rewards points are expiring has been flagged. 
 
The messages aim to trick recipients into revealing sensitive information.

The messages create urgency by claiming customers must redeem their points immediately or lose them, encouraging recipients to click an embedded link.

Instead of directing users to an official T-Mobile service, the link leads to a fraudulent website designed to imitate a legitimate rewards or redemption portal.

The attack demonstrates how cybercriminals increasingly exploit trusted brands, loyalty programs and time-sensitive offers to lower users’ suspicion and encourage impulsive action.

Once victims engage with fraudulent sites, attackers may attempt to collect personal information, account credentials, payment-card details or other sensitive data.

The campaign reinforces an important security principle: unexpected rewards messages should be independently verified through a company’s official application or website rather than through links received by SMS.

As phishing becomes more convincing, users need to treat urgency, expiring rewards and unexpected links as warning signals, even when messages appear to come from familiar brands.