Fake T-Mobile Rewards Texts: How the Phishing Campaign Works

Text messages claiming your T-Mobile Rewards points are about to expire have been reported as a large phishing campaign. This explains how the messages and fake pages work, what they ask for and how to check a link before you tap it.

By · Updated

Holyprofweb editorial graphic: T-Mobile Rewards texts

Text messages telling you that your T-Mobile Rewards points are about to expire have been reported by security researchers as a phishing campaign. The links lead to look-alike pages that ask for passwords, card details and one-time codes. If you received one, do not tap the link; check your account by opening the T-Mobile app or typing the website address yourself.

At a glance

  • What it is: a mass SMS phishing (“smishing”) campaign using T-Mobile’s name.
  • The lure: a message saying a points balance, for example “18,400 T-Mobile Rewards points”, will expire soon, with a link to redeem it.
  • Tracked since: early May 2026, according to Malwarebytes as reported by security news sites.
  • Scale reported: more than 1,000 closely related message templates and at least 81 domains over about four months.
  • What the fake pages seek: passwords, card data and one-time verification codes.

How the messages work

Security news coverage of Malwarebytes’ analysis describes texts that open with a generic greeting such as “Dear T-Mobile Customer” and push you to redeem points before a deadline. The wording is varied slightly from message to message, which helps the campaign slip past simple filters. The links use short-lived domains made to look like T-Mobile addresses, typically a random string of letters on a .top domain, for example a hostname that starts with t-mobile. followed by random letters and ending in .top.

How to check a link

Read a web address from the right. The part just before the first single slash, and the last two pieces before it, show who really owns the site. In an address that begins t-mobile. and ends in .top, the owner is the random name plus .top, not T-Mobile. T-Mobile’s own site is t-mobile.com. If a message makes you hurry, treat that as a reason to slow down.

What to do

  1. Do not tap the link or reply, including replying “STOP”.
  2. Open the T-Mobile app or type the website address yourself to see whether you have any rewards or account notices.
  3. Forward the message to 7726 (SPAM), the short code US carriers use for reporting unwanted texts, then delete it.
  4. If you already entered details: change that account’s password, contact your card issuer about the card you used, and treat any one-time codes you gave out as compromised.

What we could not verify

We did not find a statement about this campaign from T-Mobile, so we do not describe T-Mobile’s rewards programmes or its position. Some commentary online makes firm claims about what T-Mobile does or does not offer; we have not confirmed them. The campaign figures come from Malwarebytes through the news coverage linked below, and we did not examine the phishing pages ourselves.

Sources

  1. Cyber Security News: Hackers Use Fake T-Mobile Rewards Expiry Texts to Lure Users to Phishing Sites (reporting on Malwarebytes’ findings)
  2. GBHackers: Scammers Tell T-Mobile Users Their Rewards Are Expiring
  3. Cyberpress: T-Mobile Rewards Phishing Campaign Uses 1,000+ SMS Variants and 81 Malicious Domains