Only days after Revolut acknowledged that it disclosed sensitive customer records to an unauthorized party, affected customers are receiving phishing texts. However, we don’t know yet if the phishing texts are linked to the breach.

The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain.

Through this social engineering attack, rather than by gaining access to Revolut’s systems, the criminals obtained the following types of information about customers:

• Identity and contact information such as dates of birth, postal addresses, email addresses, and phone numbers
• Copies of IDs such as passports and driver’s licenses
• Verification selfies
• Account statements and transaction histories

Revolut has said only that a “limited” or “very limited” number of customers were affected, and that it contacted them directly.

One affected customer received a phishing text on Monday, September 14, two days after Revolut publicly acknowledged the data breach. The message appeared in the same conversation as other Revolut texts, making it look as though it had come from the bank.

According to VirusTotal, the phishing domain was first scanned that same day.

In a separate example, another customer said that opening the link took them to a web page that requested access to their device’s camera. If you tap Allow, the page reportedly imitates Revolut’s live-video “turn your head” identity check before prompting you to enter a password.

This makes the phishing page appear more authentic. It may also allow the scammers to collect a selfie or video that could be used for further social engineering, identity fraud, or to make subsequent scams more convincing.

A convincing fake liveness check followed by a password screen is a common way to lower suspicion and obtain the information attackers need to attempt a real login or account-recovery flow.

If the campaign is connected to the breach, the information obtained from Revolut, combined with login details entered by victims or their approval of a login request, could be enough to take over their accounts.

How to stay safe

We don’t yet know whether the phishing campaign is using data exposed in the breach or whether unrelated scammers are exploiting news of the incident to target Revolut customers more broadly.

Either way, treat unexpected messages about your account with caution:

• Don’t follow links in unsolicited messages. If a message concerns your account, open the official Revolut app directly.
• Check the actual domain in your browser’s address bar to see if it corresponds with what you expect.
• Use an up-to-date, real-time anti-malware solution on your device, preferably with a web protection component.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Since early May 2026, we’ve been monitoring a large phishing campaign based on T-Mobile rewards points.

The messages falsely warn that a customer’s rewards points are about to expire. They aren’t legitimate account notices: They use urgency, invented point balances, and phishing links to push recipients into acting before they can verify the claim.

A typical message says that a T-Mobile Rewards account holds 18,400 points, gives an imminent expiry date, and states that unused points will be removed under the program’s terms. These details make the message look as though it was written specifically for the recipient, even though it was sent to many people.

“T-Mobile Rewards Points Reminder: Your Points Are About to Expire

Dear Customer,

We are hereby reminding you that your T-Mobile Rewards account points are about to expire. You currently have 18,400 points, which will expire on June 4, 2026, if unused.

Your Points Overview:

Current Balance: 18,400 Points

Expiry Date: {today or tomorrow}

Points will not be recovered after this date.

Redeem Points:

Visit:

https://t-mobile.{rotating domains}.top/pay

Use the T-Mobile App: Account > Rewards & Benefits

Our points expiry policy aims to ensure the fairness of the program and encourage active participation. Please don’t let these valuable points go to waste.

Thank you for choosing T-Mobile.

Customer Service Team”

This phishing operation does not rely on a single, identical SMS. We found more than 1,000 closely related campaign templates with a semantic similarity score of at least 0.60. The 199 closest matches all scored at least 0.95.

This means the variations only change superficial elements, such as the salutation, headline, expiry date, point balance, and whether the message is called a “reminder,” “alert,” or “important update.” The central story remains the same: T-Mobile rewards points are supposedly expiring, and the recipient must follow a link to redeem them as soon as possible.

The messages use formal but generic language, such as “Dear T-Mobile Customer,” “Dear Valued Customer,” or “T-Mobile User,” rather than naming the recipient or providing verifiable account information.

The campaign began slowly before producing two huge spikes in activity. The green line shows detections of message variants seen previously, while the red line shows messages detected on the first day that particular variant appeared. We’re still seeing messages from the campaign, although activity has fallen considerably since those spikes.

The scam relies on a familiar social engineering formula: a valuable-looking reward, a deadline, and a simple action that supposedly protects the customer from losing out. A recipient who has a T-Mobile account may click first and question the message later.

The links use rotating domains designed to look as though they belong to T-Mobile. Their purpose is to persuade recipients to follow the link to supposedly redeem their points. Do not enter login credentials, personal information, payment details, or verification codes after following a link in an unsolicited message.

How to stay safe

The anonymized data used in this analysis was gathered through Text Protection in Malwarebytes Mobile Security, which alerts users to potentially malicious or scam text messages. 

You can also reduce your risk by following these tips:

• Don’t follow links in unsolicited messages. Instead, open the alleged sender’s website or app independently and check for notifications there.
• Check the domain in your browser’s address bar to make sure it matches the site you expected to visit.
• Use an up-to-date, real-time anti-malware solution with web protection.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

The URLs in this campaign are very short-lived. The criminals used at least 81 domains over four months, but the domains follow a recognizable pattern that is blocked in Malwarebytes Browser Guard.

IOCs

Example domains showing the pattern used by the campaign:

t-mobile.biktpw[.]top

t-mobile.cugbjl[.]top

t-mobile.cymfjd[.]top

t-mobile.gdikxv[.]top

t-mobile.hdzcnb[.]top

t-mobile.koxetp[.]top

t-mobile.nxdcfp[.]top

t-mobile.pkrbai[.]top

t-mobile.qfrhkt[.]top

t-mobile.qscizj[.]top

t-mobile.tmfncb[.]top

t-mobile.vmnqsu[.]top

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →