T‑Mobile customers hit by fake rewards‑expiration texts in new phishing wave

A widespread SMS phishing operation is masquerading as messages from T‑Mobile, warning recipients that their loyalty‑program points are about to expire. The texts claim the users have large, fabricated balances and provide a short‑dated deadline to redeem the points, directing recipients to counterfeit redemption pages that harvest login credentials and personal data.

The fraudulent messages mimic the visual style of T‑Mobile communications, using the carrier’s logo and a tone of urgency. Each alert lists a specific points total—often in the thousands—and urges the recipient to click a link that appears to lead to the official rewards portal. In reality, the URLs are slight variations of T‑Mobile’s legitimate site, designed to deceive even vigilant users.

Security researchers who have been monitoring the campaign say the operation is being run at a large scale, with thousands of unique phone numbers targeted across the United States. By analyzing the message content and the hosting infrastructure of the phishing sites, the analysts were able to trace the links back to a handful of domains that have been repeatedly used in previous smishing attacks. The researchers have not disclosed the exact number of victims, but they note a sharp increase in reports of suspicious T‑Mobile texts over the past several weeks.

T‑Mobile does operate a rewards program that allows customers to earn points for device purchases and service plans, but the company typically notifies users of point balances through its official app or secure email, not via unsolicited text messages. Moreover, genuine communications never demand immediate action through a link; instead, they direct customers to log in through the official app or website. The discrepancy between the authentic process and the phishing messages is a key indicator that the alerts are fraudulent.

The incident reflects a broader surge in smishing attacks, where scammers exploit the trusted nature of mobile messaging to bypass traditional email filters. Text messages are perceived as more personal and are often opened without the same level of scrutiny applied to emails. Attackers capitalize on this by crafting messages that invoke fear of loss—such as expiring rewards—to prompt rapid clicks, thereby increasing the likelihood of credential theft.

Consumers are advised to verify any unexpected reward notifications by opening the T‑Mobile app or contacting the carrier directly, rather than following embedded links. T‑Mobile has issued a statement reminding customers that it will never request personal information through unsolicited SMS and that it is working with law‑enforcement agencies to identify the perpetrators. As investigators continue to map the infrastructure behind the campaign, heightened awareness and cautious handling of unexpected texts remain the most effective defense against this type of fraud.