Fake T-Mobile Rewards Texts Use Expiring Points to Steal Data

Malwarebytes says a large phishing campaign has been sending fake T-Mobile rewards messages since early May 2026. The texts falsely claim that recipients have a specific points balance, often 18,400 points, which is about to expire, and urge them to redeem it immediately. The messages use generic greetings rather than verifiable account information, while rotating links use T-Mobile-like subdomains on unrelated `.top` domains. Malwarebytes says the campaign is designed to create urgency and has not been confirmed as a legitimate T-Mobile account notification.

Researchers identified more than 1,000 closely related templates, with the 199 closest matches recording a semantic similarity score of at least 0.95. Variations generally alter superficial details such as the balance, date, greeting and wording. Malwarebytes observed two major spikes in detection activity, although messages were still being seen at a lower rate by 17 September 2026. The operation used at least 81 domains over four months, and the domains were described as short-lived.

Recipients should not follow links in unsolicited texts or enter login credentials, personal information, payment details or verification codes. Instead, they should check their account through the official T-Mobile website or app, opened independently, and verify the domain before submitting information.