T-Mobile Phishing Scam Uses Fake Reward Expiry Texts

Key Takeaways

• A sophisticated SMS phishing (smishing) campaign is targeting T-Mobile customers with fake reward expiry notifications.
• Attackers are using over a thousand varied message templates and rapidly changing domains to evade detection and trick users into visiting malicious sites.
• The campaign aims to steal login credentials, personal data, payment information, and multi-factor authentication codes.
• This ongoing threat has been active since at least May 2026, with a high volume of deceptive messages observed.

A widespread and persistent phishing campaign is leveraging text messages to impersonate T-Mobile, coercing subscribers into navigating to fraudulent webpages designed to harvest sensitive personal and financial data. This deceptive operation has been active since at least early May 2026, maintaining its reach despite some fluctuations in volume.

The attackers behind this campaign exhibit a high degree of adaptability, constantly altering minor details within their messages. This tactic enables them to deploy the same underlying deception at scale while simultaneously bypassing rudimentary detection mechanisms that rely on exact message matching. According to Malwarebytes said in a report, their analysts have identified over 1,000 closely related message templates, with 199 exhibiting significant similarities.

The effectiveness of this smishing campaign stems from its psychological manipulation. Attackers craft messages that combine fabricated loyalty point balances, urgent expiration deadlines, and constantly changing links. This strategy pressures recipients into taking immediate action without verifying the authenticity of the claim, leading them to compromise their login details, personal information, payment data, and even one-time verification codes.

Hackers Exploit Urgency with Fake T-Mobile Rewards Expiry Texts

A typical phishing lure informs the recipient that they possess a specific, often high, number of T-Mobile Rewards points—for instance, 18,400—which are set to expire either on the same day or the following day. The message then provides a link, framing it as the only way to redeem these points, and presents the deadline as a legitimate aspect of T-Mobile’s rewards policy.

While the stated point balance and expiry date are entirely fabricated, they lend a personalized veneer to the message. The precise wording of these texts is subject to continuous variation. Attackers frequently modify greetings, subject lines, the purported point balances, and expiration dates. However, the core deceptive claim remains consistent: valuable rewards are at risk of being lost unless the recipient clicks the provided link immediately.

A crucial red flag often present in these messages is the use of generic salutations, such as “Dear T-Mobile Customer.” The absence of specific account details in the greeting should serve as an immediate warning sign to recipients.

The embedded links direct users through ephemeral domains specifically created to mimic legitimate T-Mobile addresses. These domains frequently utilize random strings of letters combined with the .top top-level domain. This infrastructure is designed for disposability. Malwarebytes observed at least 81 such domains over a four-month period. This rapid rotation complicates efforts to blocklist malicious sites and ensures that criminals have fresh addresses available when older ones are reported.

This method of brand impersonation is not exclusive to rewards programs. Previous large-scale iMessage smishing campaigns have similarly employed lookalike web addresses and familiar service names to erode user vigilance. The consistent element across these attacks is the application of psychological pressure: the promise of an attractive benefit, the threat of an imminent loss, and a seemingly simple solution presented as the only recourse.

What You Should Do

• Do Not Click Unsolicited Links: Never click on links embedded in unexpected text messages, regardless of how convincing they appear.
• Verify Directly: If you receive a message about expiring rewards or account issues, independently navigate to T-Mobile’s official website or open their official mobile application. Log in directly and check for any legitimate notifications there.
• Avoid Data Entry: If you land on a suspicious page, do not enter any credentials, personal information, credit card details, or one-time verification codes.
• Inspect URLs: Before entering any sensitive information, always check the full browser address (URL) to ensure it is the legitimate T-Mobile domain. A convincing logo does not guarantee authenticity.
• Report Suspicious Texts: Report any suspect text messages to your mobile carrier and platform. Replying to unknown senders can confirm your number is active, making you a target for more scams.
• Immediate Action After Compromise: If you have already provided information, immediately change the affected password, especially if it was reused on other services. Review your account activity for unauthorized transactions and contact your financial institution if payment details or verification codes were shared.
• Use Official Contacts: Obtain account recovery or support contact information only from official T-Mobile websites, statements, or applications, not from the original phishing text.
• Stay Vigilant: Remember that urgency is a common tactic used by scammers. Legitimate organizations will not pressure you to click links in unsolicited messages. A brief pause to verify can prevent significant losses.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.