A recent phishing scheme has been uncovered that targets AT&T customers with deceptive text messages claiming rewards points are about to expire. These messages prompt users to act quickly to claim their rewards by following a link that is actually designed to collect sensitive personal information.
AT&T rewards scam exposes personal data
Individuals receiving these messages are confronted with a "Rewards Expiration Notice," urging them to redeem points in their AT&T account before they expire. The text specifies a points balance and an expiration date, along with two suggested methods for redemption:
1. AT&T Rewards Center
2. AT&T Mobile App: Rewards section
According to findings from cybersecurity experts, the provided link redirects users to a fraudulent website mimicking AT&T's branding. Upon entering their phone number for account verification, users are met with alarming messages about points expiring and various enticing reward options, such as the latest Apple Watch or popular gift cards.
To finalize the reward claim and arrange delivery, victims are asked to provide additional personal information, which is then sent directly to the scammers. The forms are designed to appear legitimate, featuring real-time validation that can mislead users into thinking they are engaging with a trustworthy source.
Identifying scam warning signs
This scam employs social engineering techniques, creating a sense of urgency and fear of missing out to manipulate targets. Despite its convincing appearance and multi-step process to build trust, several warning signs are evident. For instance, the text originates from a standard phone number instead of a short code typically used for automated messages, and the sender is not recognized as an official AT&T contact. Additionally, the message includes multiple recipients and a generic greeting.
The shortened URL leads to a site that is not affiliated with AT&T. While the page may look credible, it contains numerous typos and formatting issues. Notably, the expiration date on the site changes if accessed on different days.
As a precaution, it is advisable to avoid clicking links in unsolicited text messages. While AT&T does offer a rewards program, users should visit the official portal directly through the web or app to manage their rewards securely.