What are the red flags of this scam?

An unexpected text or email from 'Qantas' warns your points will expire today or within hours • The message offers a luxury prize (iPhone, Dyson appliance, Coles voucher) for redeeming points • You are told to reply 'Y' to activate a link, or to copy-paste the URL — tactics designed to bypass phone security • The link does not go to qantas.com or qantaspoints.com — check the URL carefully before entering anything • The fake login page looks identical to the real Qantas Frequent Flyer portal but asks for your full password or one-time code • Qantas does not ask for your PIN, password, or one-time passwords by text or email

What should I do if this happened to me?

Do not click the link — open the Qantas app directly or type qantas.com manually to check your actual points balance • Do not reply 'Y' to any text claiming to be from Qantas about points or prizes — Qantas does not use this method • Check the URL in any 'Qantas' message before entering credentials — the real site is qantas.com, not any variation • If you entered your credentials on a suspicious site, change your Qantas Frequent Flyer password immediately at qantas.com and enable two-factor authentication • Forward suspicious Qantas messages to security@qantas.com.au so they can take down the phishing page • Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.

MEDIUM phishing Last reported: 23 Oct 2026 Share

A Qantas text says your Frequent Flyer points expire today — the link steals your login

Q: Is this a scam?

Yes. This is a documented scam pattern. Scammers send SMS or email impersonating Qantas claiming your Frequent Flyer points expire today. The link leads to a fake Qantas login page that steals credentials and personal details. Linked to the 2025 data breach affecting 5.7M customers; Qantas is now one of Australia's three most-targeted loyalty programs.

Scammers send SMS or email impersonating Qantas claiming your Frequent Flyer points expire today. The link leads to a fake Qantas login page that steals credentials and personal details. Linked to the 2025 data breach affecting 5.7M customers; Qantas is now one of Australia's three most-targeted loyalty programs.

Also known as: Qantas points expiring text scam, Qantas Frequent Flyer phishing, fake Qantas SMS Australia, Qantas loyalty smishing, Qantas prize scam, Qantas impersonation email

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.

What to do right now

1 Do not click the link — open the Qantas app directly or type qantas.com manually to check your actual points balance
2 Do not reply 'Y' to any text claiming to be from Qantas about points or prizes — Qantas does not use this method
3 Check the URL in any 'Qantas' message before entering credentials — the real site is qantas.com, not any variation
4 If you entered your credentials on a suspicious site, change your Qantas Frequent Flyer password immediately at qantas.com and enable two-factor authentication
5 Forward suspicious Qantas messages to [email protected] so they can take down the phishing page
6 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.

Red flags

⚠ An unexpected text or email from 'Qantas' warns your points will expire today or within hours
⚠ The message offers a luxury prize (iPhone, Dyson appliance, Coles voucher) for redeeming points
⚠ You are told to reply 'Y' to activate a link, or to copy-paste the URL — tactics designed to bypass phone security
⚠ The link does not go to qantas.com or qantaspoints.com — check the URL carefully before entering anything
⚠ The fake login page looks identical to the real Qantas Frequent Flyer portal but asks for your full password or one-time code
⚠ Qantas does not ask for your PIN, password, or one-time passwords by text or email

Known variants

Qantas Hotels WhatsApp phishing: Targeted WhatsApp messages claim to be from a hotel where the customer has a real booking, requesting payment confirmation or credit card pre-authorisation. Messages used real booking details from the 2025 Qantas data breach. Capella Sydney confirmed affected in September 2026.

Last seen: 10/4/2026
CommBank Awards-to-Yello transition phishing (October 2026): scammers sent SMS claiming CommBank Awards points would expire before the real September 29 program closure, linking to a fake NetBank login page. A second wave used 'your Yello points are ready to redeem'. CommBank issued an urgent alert — it never sends SMS with links to redeem points.

Last seen: 10/23/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources