“Your T-Mobile Points Expire Today” — There Are No Points, and the Link Isn't T-Mobile (2026)

No — don't click. There are no points, and the link isn't T-Mobile. Malwarebytes has tracked the campaign since early May 2026: more than 1,000 near-identical message templates pushed through at least 81 rotating lookalike domains, all following the pattern t-mobile.<random-letters>.top. The formula is a valuable-looking reward, a deadline of today or tomorrow, and one simple action — a page that harvests your login, personal information, payment details, or a verification code. Check your account only inside the T-Mobile app or on the site you type in yourself; real carrier notices don't live on random .top domains.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — September 29, 2026 →

Why you’re seeing this now

Security researchers at Malwarebytes have tracked this campaign since early May 2026, and it spiked again this month: more than 1,000 message templates — the 199 closest variants are over 95% identical, changing only the greeting, headline, balance, and expiry date — pushed through at least 81 rotating lookalike domains in four months, all following the pattern t-mobile.<random-letters>.top. The formula is the oldest in the book: a valuable-looking reward, a deadline, and one simple action that supposedly protects you from losing out. The link's job is to walk you to a page where you'll type in login credentials, personal information, payment details, or a verification code. It's the same points-costume as last edition's airline and hotel loyalty phishing, moved onto your phone carrier — and it works because plenty of T-Mobile customers can't say for sure whether they have points. Check only inside the T-Mobile app or the site you type in yourself; real account notices don't live on random .top domains.

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

“T-Mobile Rewards Points Reminder: Your Points Are About to Expire… You currently have 18,400 points, which will expire… if unused.” — sent to thousands of people carrying the same invented balance, with the expiry date set to today or tomorrow.

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

Five red flags — any one is enough

A text claims your carrier rewards points expire today or tomorrow.

A precise-looking balance — 18,400 points — you never signed up to earn.

The link sits on a lookalike domain — t-mobile.<random>.top — not t-mobile.com.

The page asks for login credentials, card details, or a verification code to “redeem.”

Generic greeting — “Dear Customer” — no name, no verifiable account detail.

Your next three moves

Verify through a channel you open yourself: open the T-Mobile app, or type t-mobile.com into your browser, and check for points and notices there. If a reward were really expiring, it would show inside your account — never only on a random .top domain a text handed you.

Refuse the redemption flow: no login credentials, card details, or verification codes to “redeem” points you never signed up to earn. The page's job is to harvest exactly those.

Report the text at reportfraud.ftc.gov and to T-Mobile — and check the link or number in the message via the $2 instant check before you tap it.

How did they know my exact points balance?

They didn't — the balance is invented. The same 18,400-point figure went to thousands of people, with only the greeting, headline, balance, and expiry date changing across more than 1,000 templates (the 199 closest variants are over 95% identical).

Does T-Mobile have a rewards program — maybe I do have points?

That uncertainty is exactly what the campaign exploits: plenty of T-Mobile customers can't say for sure whether they have points. Check only inside the T-Mobile app or the site you type in yourself — real account notices don't live on random .top domains.

The link says t-mobile — how is it fake?

Read the whole domain: the campaign rotates through at least 81 lookalikes following the pattern t-mobile.<random-letters>.top. t-mobile.com is the carrier; t-mobile.<anything>.top is the costume.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.