Fake Loyalty Points Redemption Scams

Fake loyalty points redemption scams target members of retail loyalty and reward programmes — supermarket points schemes, cashback cards, retail reward apps, and similar. The scammer sends a message, typically by email or SMS, claiming that a significant points balance is about to expire and offering a simple link to redeem the points before they are lost.

The link leads to a page designed to look like the official loyalty scheme login. When the victim enters their credentials, those details are captured by the scammer. In some variants, the fake page offers to convert points to cash or vouchers and requests payment card details to 'process the transfer' — a straightforward card harvesting operation.

Because loyalty points can represent genuine value — discounts, free products, or cashback — and because expiry warnings are a legitimate feature of many loyalty schemes, the messages are highly persuasive.

The scammer obtains a list of email addresses or phone numbers, either from a data breach or from a purchased marketing list. They send bulk messages impersonating a well-known loyalty programme — usually one with very large membership, ensuring a proportion of recipients are actual members.

The message warns that a specific quantity of points (sometimes a genuine-sounding number) will expire within 48 to 72 hours unless redeemed immediately. A link is provided to a cloned version of the loyalty scheme's website, complete with the correct logo, colour scheme, and layout.

Victims who log in have their credentials recorded. If the scheme has no two-factor authentication, the scammer immediately accesses the real account and drains the points balance by redeeming vouchers or transferring points. If the fake page requests card details for a points-to-cash conversion, those details are also harvested.

Expiry warnings are a genuine, routine feature of loyalty schemes, making the premise entirely believable. The risk of losing value that was already earned creates a sense of urgency that overrides careful checking. Many loyalty programme pages look similar enough to clones that visual inspection alone is insufficient. Members may not regularly check their balance, so they cannot immediately tell whether the claimed expiring amount is accurate.

A shopper receives a text message claiming their supermarket loyalty points worth [a significant redemption value] expire in 48 hours. The link takes them to a page that looks exactly like the supermarket's loyalty app login. They enter their email and password. The page thanks them and redirects to the real supermarket site. Shortly after, they receive a genuine notification that their points balance has been redeemed for gift cards they did not order.

[Retail programme]: your [amount] reward points expire in 48 hours. Tap here to redeem before they are lost: [fake link]

URGENT: [supermarket] Reward Points Expiry Notice. [amount] points due to expire [date]. Click to save your balance now.

Convert your [retail] points to [amount] cash today. Enter your account and payment details to receive your transfer: [fake link]

Never follow a link in a loyalty points expiry email. Instead, open your browser and type the scheme's official web address directly, or use the official app. Log in through the genuine site and check your actual balance and expiry dates. If the email claimed points were expiring and your genuine account shows no such expiry, the message was fake. Report the phishing email to the loyalty programme using contact details from their official website.