Mobile users in the UK are being targeted by a sophisticated text message scam impersonating rewards programs from major mobile carriers, EE and Vodafone. The scam, which has been reported by over 265,000 EE customers in the past two months, lures recipients with the promise of substantial reward points, often exceeding 12,000, that are nearing expiration. While the specific details vary, the core tactic relies on creating a sense of urgency to trick users into divulging personal and banking information.
How the Scam Works
The scam begins with a text message informing the recipient they have accumulated a significant number of reward points through their mobile provider. These points are presented as being available for redemption on a variety of high-value items, such as massage chairs and high-end vacuum cleaners. Crucially, the message warns that these points will expire within a few days if not used, pressuring the recipient to act quickly.
Victims who click the link provided in the text message are directed to a website that closely mimics the legitimate branding of their mobile carrier. This site displays the promised rewards and requests the user to provide bank details to cover the postage costs associated with receiving the item. However, providing this information allows the scammers to exploit the victim’s financial details. According to reports, after entering bank details, users are often redirected to a blank page, indicating the fraudulent nature of the scheme.
Technical Details and Evolving Tactics
EE has identified that these scam messages are being sent via RCS (Rich Communication Services), a more advanced messaging protocol than traditional SMS. Unlike SMS, EE currently lacks the ability to block RCS messages, making it more difficult to prevent the scam from reaching users. EE is collaborating with Apple and Google to address this limitation. Vodafone, while less affected due to RCS not being widely enabled on iPhones, has also seen variations of the scam circulating, often referring to a non-existent “Vodafone Rewards Club” instead of their legitimate VeryMe Rewards scheme.
The sophistication of the scam lies in its ability to appear legitimate. Scammers avoid obvious spelling errors and aggressive language, opting for a professional and calm tone. This, combined with the familiarity of reward schemes offered by mobile networks, banks and retailers, makes the scam particularly convincing. The use of a specific points balance – often around 12,739 – adds a layer of perceived authenticity.
Why This Scam is Effective
The success of this scam hinges on several psychological factors. The promise of a reward taps into a sense of entitlement and potential gain. The limited timeframe for redemption creates a sense of urgency, bypassing rational thought and encouraging impulsive action. The professional presentation and branding further contribute to the scam’s believability.
As one EE user reported, the website appeared legitimate and offered a range of prizes in exchange for the reward points. This underscores the scammers’ ability to create convincing replicas of official websites.
What to Do If You Receive a Suspicious Text
If you receive a text message claiming to be from EE or Vodafone offering reward points, the advice is clear: do not click on the link. EE advises users to report the message as spam through their mobile phone’s built-in reporting function. Alternatively, the message can be forwarded to 7726 free of charge.
If you have already clicked the link and provided personal or banking information, it is crucial to contact your bank immediately to report the incident. You should also report the scam to Report Fraud (formerly Action Fraud).
The Broader Context of Smishing
This scam is a prime example of “smishing,” a type of phishing attack that uses SMS text messages to trick victims into revealing sensitive information. Smishing attacks are becoming increasingly sophisticated, leveraging newer messaging technologies like RCS to bypass traditional security measures. The rise of smishing underscores the need for increased vigilance and awareness among mobile users.
While EE and Vodafone are actively working to combat these scams, the evolving nature of the threat requires a multi-faceted approach, including technological solutions, user education, and collaboration between mobile carriers, technology companies, and law enforcement agencies. The fact that EE has received reports from 265,000 customers in just two months highlights the scale of the problem and the urgent need for effective countermeasures.
