A new phishing scheme is exploiting T-Mobile’s name to trick users into visiting deceptive websites under the guise of redeeming expiring rewards. This scam, which started in early May 2026, has persisted despite a decline in its initial intensity.
How the Phishing Scam Operates
The fraudulent messages falsely inform recipients that their loyalty points are about to expire, pushing them to click on malicious links. These links are designed to capture sensitive information such as login credentials, personal data, and payment details.
Malwarebytes researchers have noted that the attackers frequently modify minor details in the messages, enabling them to bypass simple filtering techniques. More than 1,000 similar message templates have been identified, showcasing the campaign’s adaptability.
Techniques Used by Scammers
Scammers in this campaign utilize fabricated point balances and pressing deadlines to create a sense of urgency. The messages often feature rotating links and false claims, leading users to believe they must act quickly to avoid losing rewards.
These phishing efforts demonstrate why SMS is still favored by cybercriminals; messages can reach users when they are less vigilant, and the prospect of losing benefits can prompt hasty actions.
Protecting Yourself from Phishing Attacks
To safeguard against such scams, users are advised not to click on links from unsolicited texts, regardless of how genuine they appear. Instead, they should verify any claims by accessing the official T-Mobile app or website directly.
It is crucial to avoid providing any personal or financial information on suspicious websites, and users should double-check the web address before entering sensitive data. If information has already been shared, immediate steps should be taken to secure accounts and notify financial institutions.
Organizations can assist by educating customers about these scams and ensuring legitimate communications are easily recognizable. Users should also report suspicious messages to their mobile service providers to help combat this ongoing threat.
