Consumer Rights · Sep 26, 2026Scammers targeting loyalty rewards programs: here’s how to stay safe

Consumer Rights · Scam Alert · September 26, 2026

Banking loyalty programs are being targeted by scammers amid one of the biggest revamps of these programs in decades.

The Story So Far

Create a free account to read this article or signup to continue reading Australian banks are set to curb credit card points and perks from October 1 after the Reserve Bank of Australia banned card surcharges. The change is set to put an estimated $1.6 billion back into the pockets of Australians each year.^[1]

Commonwealth Bank has warned its customers scammers are sending phishing text messages, adding further confusion about the changes. The messages impersonate CommBank and claim that rewards points are about to expire.^[1]

The goal is to get the person to click a link and visit a fake website, where scammers collect banking details, card information or personal information. James Roberts, executive general manager of fraud and scams, told The Senior banks will never ask a customer to "share passwords, PINs or one-time codes, or move money to a 'safe account'."^[1]

"Banks won't rush you," he said.^[1]

Every tactic above beats a specific human default. None of them beat a phone number you looked up yourself.

How to Spot & Avoid This Scam

This is what the approach actually looks like — study it before the list below:

The text sends you to a fake “CommBank Awards” page on a non-CommBank web address. CommBank’s alert shows it listing the same 12,085-point balance and a date the points “may expire”, next to prize items such as headphones and a smartwatch, plus a follow-up page telling you to act before the points expire. Source: CommBank’s scam alert, August 2026.

How to Protect Yourself

• Slow down. Real organizations do not require you to act within minutes or hours to avoid a penalty.
• CommBank says it will not ask you to redeem points via a link in an email or SMS message. Open the CommBank app or type the bank’s address into your browser instead.
• Don’t reply to an unexpected message. Replying tells the sender your number is live.
• Verify any unexpected contact through a phone number or website you already know is real — never one the message itself provides.

If You Already Clicked or Replied

Responding to one of these is not the end of the story, and the first hour matters more than the mistake does. Work down this list in order:

1. Stop communicating with the sender. Do not send a final message explaining that you know it is a scam — that only confirms the number or address is live.
2. If you shared a password, change it everywhere you reused it, starting with email and banking. Reused passwords are how one disclosure becomes several.
3. If you shared card or bank details, call the number printed on your card and ask for the account to be flagged and reissued.
4. If you sent money by gift card, call the card issuer immediately — some balances can be frozen if the cards have not been drained yet.
5. Turn on two-factor authentication where it is offered, so a stolen password alone is not enough to get in.
6. Report it (see below). Reports are what let investigators connect one message to a wider campaign.

Where to Report It

• Federal Trade Commission — reportfraud.ftc.gov is the FTC’s own intake for fraud reports.^[2]
• FBI Internet Crime Complaint Center — ic3.gov handles internet-enabled crime, including losses already incurred.^[3]
• The impersonated organization — most banks and large platforms run their own abuse address; reporting there is what gets a fraudulent number or domain taken down.

What’s Disputed or Unconfirmed

This post reports what thesenior.com.au published and what a fixed detector matched in that text. It does not independently confirm the scale of the campaign, attribute it to anyone, or verify any figure the source reports. The message shown above is transcribed from a screenshot in CommBank’s own alert, so its wording is the real text of a message CommBank published. We have not independently verified how many people received it, who sent it, or the scale of the campaign.

Consumer Protection & Settlement Resources

How to Verify This Yourself

Read the original alert directly at thesenior.com.au^[1] — that page is the primary source for everything above. For the recovery steps, the FTC publishes its own guidance on what to do after a scam.^[4]

Kemetic Minds Analysis

Scam reporting tends to arrive as a list of things not to do, which puts the burden entirely on the person being targeted. The more useful read is structural: every tactic in the table above exists because it reliably beats a specific human default — trusting a familiar logo, acting fast under a deadline, believing a stranger who already seems to know something about you.

None of those defaults are failures of intelligence. They are the same instincts that make ordinary transactions possible. That is why “just be careful” does not work as advice, and why the one habit worth building is mechanical rather than judgmental: when a message asks for money, credentials, or speed, verify it through a channel you chose yourself. That single rule defeats every tactic listed above, without requiring you to spot which one you are looking at.

References

1. thesenior.com.au. Scammers targeting loyalty rewards programs: here’s how to stay safe. — primary source for this alert. ↩
2. Federal Trade Commission. Report Fraud. — primary (U.S. government agency). ↩
3. FBI Internet Crime Complaint Center (IC3). — primary (U.S. government agency). ↩
4. Federal Trade Commission. What To Do if You Were Scammed. — primary (U.S. government agency). ↩

Related Reading

• More Consumer Rights coverage — the running Scam & Cybersecurity Watch archive.
• FTC: What To Do if You Were Scammed — the full official recovery guide.

Investigative methodology: this update was produced by scripts/scam_monitor.py from a real thesenior.com.au alert — not a language model. The quoted text above is verbatim from the source; the message shown is transcribed from the screenshot in CommBank’s own scam alert (see its caption). Protection tips, red-flag explanations, and recovery steps are matched from fixed curated tables, not generated per story. The “Kemetic Minds Analysis” section is standing editorial commentary about how these tactics work in general — it is identical on every Scam Watch post and is not reporting about this particular alert.

Kemetic Minds Editorial Desk

Verified Newsroom

Primary-sourced investigative intelligence on civil rights, voting rights, federal policy, and consumer protection. Sourced from primary legal filings, government statistics, and direct field reporting.

Editorial Standards & Policy → Join Telegram Alerts →