Mobile phone users across the UK are being warned about a sophisticated new text message scam that impersonates major network providers like EE and Vodafone. The fraudulent messages claim customers have accumulated thousands of reward points that are about to expire, urging them to click on a link to redeem prizes. However, this is a criminal ruse designed to harvest sensitive banking information.
The Scale of the Scam
Since EE first became aware of this scam two months ago, a staggering 265,000 of its customers have reported receiving these deceptive text messages. A spokesperson for EE confirmed that the company does not operate any points-for-rewards scheme, making these communications entirely fraudulent. Vodafone has also issued warnings, noting that while it runs the VeryMe Rewards programme, it never refers to it as the "Vodafone Rewards Club"—a name used in some of the scam texts.
How the Scam Operates
The text messages typically claim that the recipient has earned a substantial number of reward points, often around 12,739, with most set to expire within a few days. For example, one message states: "This message serves as an advance notice regarding your Vodafone Reward Points. You currently hold 12,739, of which 12,000 points are scheduled to expire in 3 days in line with the 2026 programme." Another, purporting to be from EE, reads: "Important Reminder about your reward points. You currently have 12,739 Reward Points available in your account. If no action is taken, these points will expire in 3 days under the terms of the 2026 Reward Points campaign."
When users click the link, they are directed to a website that mimics the legitimate branding of their mobile provider. The site offers high-value items such as massage chairs or premium vacuum cleaners in exchange for points, requesting only a small postage payment. However, entering bank details to complete the transaction leads to a blank page or error, with criminals capturing the information for fraudulent use.
Technical Challenges in Blocking
EE has highlighted that these messages are sent via RCS (Rich Communication Services), a more advanced messaging protocol than traditional SMS. Unlike SMS, which EE can block, RCS messages are harder to intercept. The company is collaborating with tech giants Apple and Google to address this vulnerability. Vodafone noted that its customers are largely protected on iPhones because RCS is not enabled by the carrier on those devices, but users on other networks may still receive the scam texts.
Protecting Yourself from the Scam
If you receive such a message, it is crucial not to click on any links. EE advises customers to use the "report spam" button on their mobile devices to flag the scam. Additionally, you can forward suspicious texts to 7726 free of charge, a service that helps track and combat fraudulent communications. If you have already provided personal or banking details, contact your bank immediately and report the incident to Report Fraud, the UK's national fraud reporting service.
This scam employs classic psychological tactics, creating a false sense of urgency to pressure victims into hasty decisions. By staying vigilant and verifying any unexpected offers directly with your mobile provider, you can avoid falling prey to these increasingly sophisticated cyber threats.
