Reward Points Scam: How Fraudsters Trick You and How to Protect Yourself

Introduction

Reward points are one of the small joys of using a credit or debit card. You pay for fuel, groceries and travel, and the points slowly build up into vouchers, cashback or discounts. Because customers value these points, fraudsters have learned to use them as bait.

You may have received a message like this one: "Dear customer, your reward points worth ₹9,850 will expire today. Click here to redeem now." The message looks official, the amount looks attractive and the deadline creates panic. This is a reward points scam, one of the fastest-growing forms of digital banking fraud in India.

In this blog, we explain what the scam is, how it works and the warning signs to look out for. We also cover simple steps to keep your money safe and what to do if you have already fallen for it.

What is a reward points scam?

A reward points scam is a type of phishing fraud. Fraudsters pretend to be your bank or card issuer and tell you that your reward points are about to lapse, or that you have won bonus points. Their real goal is not your points. They want your card number, expiry date, CVV, OTP, net banking password or remote access to your phone. Once they have these, they can make purchases or move money out of your account within minutes.

The scam works because it combines two strong emotions: the excitement of getting something of value, and the fear of losing it if you do not act quickly.

How does the reward points scam work?

The method varies, but most cases follow a similar pattern.

• The bait arrives. You receive an SMS, WhatsApp message, email or phone call claiming your reward points are expiring today or that you are eligible for a special redemption offer. The sender’s name and logo are designed to look like those of your bank
• You are pushed to a fake link or app. The message carries a link to a website that looks almost identical to the bank's official page. In some cases, you are asked to download an app, often sent as an APK file on WhatsApp, which secretly reads your messages or lets the fraudster control your screen.
• You are asked for your details. The fake page asks for your card number, expiry date, CVV, date of birth or net banking login "to verify your identity and credit the points".
• The OTP is taken. You receive an OTP, and the page or caller asks you to share it to "complete the redemption." In reality, the OTP is authorising a transaction that the fraudster has already initiated using your card details.
• The money is gone. Within moments, your card is used for online purchases or wallet loads, or funds are transferred out. The supposed reward points never existed.

Common types of reward points scams

• Fake SMS and WhatsApp messages. These are the most common form. They carry a short link and an urgent deadline.
• Phishing emails. Well-designed emails with bank logos and a "Redeem Now" button that leads to a fake website.
• Fraud calls (vishing). A caller posing as a bank executive offers to redeem your points on your behalf and asks for card details and an OTP.
• Fake apps and APK files. You are asked to install a "rewards app". Once installed, it can read your OTPs or give the fraudster remote access to your phone.
• Fake websites and search ads. Lookalike redemption portals that appear when you search for your bank's rewards page online.
• Fake customer care numbers. Wrong helpline numbers placed on websites, social media posts or search results so that you call the fraudster yourself and share your details.
• "Processing fee" or advance payment requests. The fraudster says a small fee, tax or "activation charge" must be paid before the points can be redeemed and sends a payment link or UPI request. A genuine bank does not ask you to pay money to redeem your own reward points.

Warning signs to watch for

Most scam messages share a few telltale features. Spotting even one of them is reason enough to stop.

• The message creates urgency, with phrases like "expiring today", "last chance" or "redeem within 2 hours".
• The link is shortened or slightly misspelt, or it does not belong to the bank's official domain.
• You are asked for your CVV, PIN, OTP or password. A bank will never ask for these to redeem points.
• You are asked to download an app from a link instead of the official app store.
• The message comes from a regular 10-digit mobile number or a personal email ID.
• The points value seems unusually high or does not match what you see in your own account.
• The message has spelling mistakes, odd formatting or a generic greeting such as "Dear customer".

How to protect yourself from reward points scams

• Check and redeem your reward points only through your bank's official website, mobile banking app or verified customer care number.
• Never click on links in unexpected messages about points, prizes or cashback. Type the bank's web address yourself instead.
• Never share your OTP, CVV, PIN or password with anyone, including someone who claims to be from the bank. An OTP is meant only for a transaction that you yourself have started.
• Download apps only from the Google Play Store or Apple App Store. Do not install APK files received on WhatsApp or by SMS.
• Do not install screen-sharing or remote access apps at the request of an unknown caller.
• Turn on SMS and email alerts for all transactions so that you notice unusual activity immediately.
• Set sensible transaction limits on your cards and switch off international or online usage when you do not need it.
• Take customer care numbers only from the bank's official website or the back of your card, not from search results or social media.
• If something sounds too good to be true, pause and think before you respond.
• Talk about these scams with family members, especially senior citizens and first-time digital banking users, who are often targeted.

What to do if you have fallen for a reward points scam

If you have shared your details or notice a transaction you did not make, act quickly. Speed makes a real difference in recovering money.

• Block your card immediately. Use your mobile banking app or netbanking or call the bank's official customer care.
• Inform your bank. Report the unauthorised transaction and ask for a complaint reference number.
• Call 1930. This is the national cybercrime helpline. You can also file a complaint at cybercrime.gov.in. Reporting early helps the authorities try to freeze the money before it moves further.
• Change your passwords and PINs. Do this for net banking, mobile banking and email.
• Remove any suspicious apps. Uninstall any app you installed at the fraudster's request and run a security scan on your phone.
• Keep all the evidence. Save screenshots of messages, the sender's number, the link and transaction alerts.
• Report the message on Chakshu. Suspicious messages and calls can be reported on the Chakshu facility of the government's Sanchar Saathi portal, so that the number can be acted upon.

Under RBI guidelines, reporting an unauthorised transaction to your bank promptly helps limit your liability. Do not delay out of hesitation or embarrassment.

Conclusion

Reward points are meant to reward you, not put your savings at risk. The reward points scam succeeds only when a customer acts in a hurry. One habit protects you: whenever you receive a message about expiring points, do not react to the message. Open your bank's official app or website and check for yourself. If the points are real, you will see them there. If they are not, you have just avoided a fraud.

Stay alert, never share your confidential details, and help spread awareness among your family and friends. Safe banking takes only a moment of caution.

Frequently Asked Questions (FAQs)

What is a reward points scam?

It is a fraud in which scammers pretend to be your bank and claim your reward points are expiring or that you have won bonus points. They use this to trick you into sharing your card details, OTP or banking credentials.

Will my bank send me a link to redeem reward points?

Banks may send information about offers, but they will never ask you to enter your CVV, PIN, OTP or password through a link to redeem points. It is always safer to log in to the official app or website directly.

How can I check my genuine reward points balance?

You can check it through your bank's official mobile banking app, net banking, your card statement or by calling the verified customer care number.

Do reward points really expire?

Depending on the card's terms, points may carry a validity period. The genuine expiry details are always visible in your official account or statement. They will not be announced through a random message with a link.

I clicked on the link but did not enter any details. Am I safe?

In most cases, clicking alone does not lead to a loss. As a precaution, close the page, do not download anything and clear your browser history. Keep an eye on your account for a few days.

What should I do if I shared my OTP or card details?

Block your card immediately and inform your bank. Call the cyber crime helpline 1930 and file a complaint at cybercrime.gov.in. The sooner you report, the better the chances of limiting the loss.

Can I get my money back after a reward points fraud?

Recovery depends on how quickly the fraud is reported and the facts of the case. Reporting right away to both your bank and 1930 improves the chances of the funds being traced and frozen.

Why do fraudsters ask me to install an app?

These apps can read your SMS messages, including OTPs, or give the fraudster remote control of your phone. This lets them complete transactions without any further help from you.

How do I report a suspicious reward points message?

Report it to your bank through its official channels and on the Chakshu facility of the Sanchar Saathi portal. Then delete the message without clicking the link.