“Your Qantas Points expire in 3 days” — real reminder, or scam?
Scamwatch issued an alert about this one in February 2026, and we have seen it forwarded steadily since. It works better than most brand impersonations for one reason: it is built on something true. Qantas Points really do expire after 18 months without any earning or spending activity, Qantas really does email members before it happens, and most people have no idea when their own points are due. So a message that says 84,300 points expire on Friday lands on a real anxiety and an unknown fact.
The page behind that link is a copy of the Qantas login. It asks for your membership number, surname and PIN — and sometimes, on the next screen, a card number “to verify your identity”. Everything you type goes to the scammer. Within an hour your points are redeemed for gift cards or flights, and if you gave a card, that's used too.
How to tell them apart in ten seconds
- Read the address before the first single slash. Genuine Qantas links go to qantas.com (sometimes via links.qantas.com or e.qantas.com, which are theirs). Anything with a hyphen, an extra word, or a different ending — qantas-loyalty-rewards.com, qantaspoints.net, qantas.com-retain.co — is a stranger's domain wearing the name. The part immediately before the first slash is the only part that counts.
- A real reminder doesn't need you to “confirm details”. It tells you to earn or use points. It never asks you to re-enter your PIN, your date of birth or a card to keep what you already have.
- Check the deadline against your own account. Open the Qantas app or type qantas.com into your browser. Your expiry date is shown on the dashboard. If it doesn't match the message, the message is lying.
- Look for the countdown. “3 days”, “expires tonight”, “final notice”. Qantas gives weeks of warning, not hours, because it has no reason to rush you.
Why the number or sender name proves nothing
These arrive by text and by email. The text can show a sender name of “Qantas” even when it isn't, and the email can carry a convincing display name over a stranger's address. Since July 2026, texts from unregistered business names may show as Unverified, which is a useful hint — but a registered-looking name is not proof either. Only the link address is.
If you already logged in
Move quickly and don't be embarrassed; this one catches careful people. Go to qantas.com yourself and change your PIN. Check your recent activity for redemptions you didn't make and ring Qantas Frequent Flyer on the number on their website — they can freeze the account and, if you act early, reverse redemptions. If you entered a card, ring your bank next. If you use the same PIN or password anywhere else, change it there too.
The person you worry about
A parent with a Frequent Flyer account they barely look at is the ideal target: the points feel like money, the deadline feels real, and they have no idea what a normal Qantas email looks like. Is it a scam? answers this one in about ten seconds — it reads the link, sees the domain isn't Qantas, and says so plainly, with the instruction to open the app instead. The genuine reminder gets a calm “this one is real, log in through the app to be safe”. Either way, nobody has to guess. You can paste any message into the free checker right now.
Common questions
Do Qantas Points actually expire?
Yes. Qantas Points expire if there is no earning or redemption activity on the account for 18 months. That is exactly why the scam works: the expiry threat is real, and most members don't know their own date. The fix is to check the date in the Qantas app, never through a link in a message.
Does Qantas send points-expiry reminders?
It does, by email, usually well before the date. A genuine reminder links to qantas.com and asks you to earn or use points. It never asks you to re-enter your PIN, date of birth or a card number to keep points you already have.
What is the real Qantas website address?
qantas.com. Marketing emails may use links.qantas.com or e.qantas.com, which are Qantas's own. Jetstar, which is part of the Qantas Group, uses jetstar.com. Anything with a hyphen or an extra word before the first single slash, such as qantas-loyalty-rewards.com, is not Qantas.
I entered my membership number and PIN. What now?
Go to qantas.com yourself and change your PIN immediately, then check recent activity for redemptions you didn't make and ring Qantas on the number from their website to freeze the account. If you also entered a card, call your bank. Change the PIN anywhere else you've reused it.
Why does the text come from a sender called Qantas?
Sender names on texts can be set by whoever sends them. Registered business names now exist in Australia and unregistered ones may show as Unverified, but a plausible name is not proof. The only thing that identifies a message as genuine is the address the link actually goes to.
Points reminders arrive every day. Only some of them are real.
Is it a scam? reads the link, not the logo, and answers in about ten seconds — real reminder, use the app; fake one, delete it. One Australian number, no app for the person you're protecting.
Set this up for someoneWant to check something now? Do that free, no sign-up. Already happened? Start here.