That Text About Your Expiring Rewards Points Is a Scam
TL;DR
- The FTC warned on April 7, 2026 about phishing texts claiming your AT&T, Verizon, or credit card rewards points are about to expire.
- The link goes to a fake login page that harvests your name, address, payment info, or Social Security number. The points are not real.
- Malwarebytes flagged an AT&T-specific version of this campaign in January 2026 as a “realistic, multi-layered data theft phishing campaign.”
- Don’t tap the link. If you really might have expiring points, open the company’s app or type the URL yourself and check directly.
- Set up keyword filters for phrases like “points expire,” “redeem now,” and “claim your reward” so the next variant goes straight to junk.
You get a text that says your AT&T rewards points are about to expire. Or your Verizon points. Or your credit card cashback. The message is urgent — use them today or lose them. There’s a helpful link right there in the text.
Don’t tap it. It’s a phishing scam, and the FTC issued a warning about it on April 7, 2026.
How the Expiring Rewards Points Scam Works
The setup is simple and effective. You receive a text that appears to come from a company you actually do business with — your phone carrier, a retailer, your bank. The message says your rewards points are about to expire and you need to act now to redeem them. It includes a link.
That link takes you to a fake website designed to look like the real company’s page. It asks you to “verify your identity” or “log in to redeem,” and in doing so, you hand over personal information: your name, address, Social Security number, credit card details, or login credentials. The scammers behind these pages aren’t trying to help you claim points. They’re harvesting data they can use for identity theft or sell on the dark web.
Malwarebytes flagged an AT&T-specific version of this scam back in January 2026, calling it a “realistic, multi-layered data theft phishing campaign.” Consumers have also reported versions impersonating Verizon, and there’s no reason to think scammers will stop at telecom companies. If a brand has a loyalty program, it’s a viable target.
Why This Scam Works So Well
Most phishing texts sound obviously fake — a package you didn’t order, a toll you don’t owe, a bank account you don’t have. But rewards points? A lot of people actually have those. AT&T Thanks, Verizon Up, credit card cashback — these are real programs with real points that people forget about. So when a text says “your points expire today,” there’s a genuine moment of “wait, do I have points I’m about to lose?” That moment of uncertainty is all it takes.
The urgency is the other weapon. Scammers don’t say your points expire next month. They say today. Right now. The time pressure short-circuits the part of your brain that would normally pause and think, “wait, why is AT&T texting me from a random number?”
This psychological playbook isn’t new, but it’s being deployed at scale. The FTC received 3 million fraud reports from consumers in 2025, up from 2.6 million the year before. Americans lost a record $15.9 billion to scams in 2025 — and text messages were the number one contact method scammers used to reach their targets. That’s not a coincidence. Texts feel personal, immediate, and harder to ignore than email.
What to Do If You Get One of These Texts
The FTC’s advice is straightforward: don’t click the link. If you think the message might be real — maybe you do have AT&T rewards points, and maybe they do expire — go check. But go check by opening the company’s app or typing their URL into your browser yourself. Never use a link from an unsolicited text message.
Beyond that:
Block the sender. On iPhone, open the message, tap the sender’s info at the top, and tap Block this Caller. It won’t stop the next scammer using a different number, but it cleans up that one.
Report the message. Forward it to 7726 (SPAM) so your carrier can flag the number. If you see a “Report Junk” option under the message, tap that too — it sends the report to Apple.
Don’t reply. Not even “STOP.” As we’ve written about before, replying to a scammer’s text confirms your number is active and makes you a higher-value target for future campaigns.
How to Stop These Texts Before They Reach You
Blocking individual numbers is fine for the texts you catch, but scammers rotate through numbers constantly. The expiring-points text you got from one number today will come from a completely different number tomorrow.
The more effective approach is filtering by content — what the message actually says, not who sent it. Phrases like “points expire,” “redeem now,” “claim your reward,” or “act immediately” show up in these scam texts over and over. If you set up keyword rules that flag messages containing those phrases, you catch the pattern instead of playing whack-a-mole with phone numbers.
That’s the approach we built Not Today around. You create keyword filters for the language scammers use, and matching messages get routed to junk automatically — before you see them, before you’re tempted to tap anything. Combined with a community database of 85,000+ reported spam numbers, it covers both the known bad actors and the new ones that haven’t been flagged yet.
Apple’s built-in “Filter Unknown Senders” helps with some of this, but it only separates messages from people not in your contacts. It doesn’t look at message content at all. A scam text with “your points expire today” gets the same treatment as a legitimate text from a new dentist’s office. Keyword filtering is the piece Apple doesn’t provide natively.
The Bigger Picture
The rewards-points scam is one move in a much larger playbook. Toll scams, delivery scams, bank fraud alerts, IRS impersonations — they all follow the same template: create urgency, impersonate someone you trust, and include a link. The FCC has documented this pattern extensively.
What’s changing is the volume and the sophistication. AI tools are making phishing texts smoother and more personalized. The days of obvious typos and broken English are fading. These messages are getting harder to spot on instinct alone, which is exactly why automated filtering matters more than it used to.
If you get a text about expiring rewards points — or expiring anything, really — take a breath. Close the message. Go directly to the source. And if you want to make sure the next one doesn’t even make it to your inbox, set up filtering that catches the pattern before you have to.
Not Today is a free spam-blocking app for iPhone. We built it to catch spam before it reaches you, using keyword rules, a community database of 85,000+ reported numbers, and optional AI detection. No account required. Download on the App Store.