Those \u201cyour T-Mobile Rewards points are about to expire\u201d texts are a phishing scam \u2014 not a real account notice \u2014 Malwarebytes threat intel reported Sept. 17. The campaign has been running since early May 2026, waving invented balances (often ~18,400 points), urgent expiry dates, and links that push you to \u201credeem\u201d before you can check.<\/p>\n
Researchers found more than 1,000 closely related SMS templates. The story stays the same; only the greeting, headline, point total, and deadline change. Links rotate through lookalike domains patterned like What normals should do:<\/strong> Don\u2019t tap SMS links. Open the official T-Mobile app or type the real site yourself and check Rewards there. Forward suspicious texts to 7726<\/strong> (SPAM). If you already entered info on a lookalike page, change your password from a trusted device, watch bank\/carrier alerts, and treat any \u201cverification code\u201d requests as hostile.<\/p>\nt-mobile.*.top<\/code> (at least 81 domains over four months) that harvest logins, payment details, and one-time passcodes. Do not type credentials or OTPs after following an unsolicited text link.<\/p>\n