Phish of the Week 05th of October

# Phish of the Week

# Phishing

Tesco Clubcard Points Expiry

Mette Luntama

Phish of the Week: Tesco Clubcard Points Expiry Scam Leading to Card Detail Theft

This phishing campaign impersonates Tesco Clubcard, the loyalty program of the UK supermarket chain, with a warning that the recipient's points expire tomorrow. Instead of being a security alert, it relies on the fear of losing rewards the recipient believes they have already earned, and it ends with a request for full card details.

How the attack works:

The attack starts with an email from a compromised external account using the display name "Tesco Clubcard." The subject line reads "Your Member Account: Balance 3,147 (Expires Tomorrow)," and the email body repeats that the points are set to expire the next day. The message includes the real Clubcard logo, a "View Account Details" button and a footer with Tesco's company details.

The button leads to a look-alike Tesco website hosted on a domain unrelated to Tesco. The first page asks the recipient to enter their mobile number to check their points balance.

After the number is entered, the site shows a points balance of 3,147, matching the email. A rewards shop then lists products such as headphones, kitchen appliances and gaming accessories. Most of them cost fewer points than the balance shown, which makes redeeming feel easy and tempting.

Once a reward is selected, the recipient is asked for their name, email address, mobile number and home address for delivery.

The final page asks the recipient to choose a delivery option, with fees ranging from £0.99 to £6.50, and to pay by card. The form requests the card details, including the security code. Clicking the "Confirm payment" button sends everything entered on the site to the attackers.

Why the attack works:

The lure offers something to keep rather than a problem to fix. Points feel like money the recipient already owns, and a one-day deadline turns that sense of ownership into pressure to act. Because the email asks the recipient to protect something they have, not to respond to a threat, it does not trigger the caution that security alerts often do.

The site keeps that feeling going by asking for very little at first. A phone number is enough to see the balance, and the shop is priced so that most items look affordable. By the time card details are requested, the recipient has already picked a reward and entered their address, so a delivery fee of a few pounds looks like a normal last step at checkout. The attackers end up with a full profile from one person: name, phone number, email address, home address and complete card details.

How to spot similar attacks:

The sender uses a brand name, but the email address has no connection to that brand

The subject line and body set a one-day deadline for points or rewards to expire

The email pushes a link as the way to act

The link leads to a domain that does not belong to the brand

A "free" reward still requires card details to pay a small fee

If a message says your loyalty points or rewards are about to expire, check your balance through a separate channel, such as the official app or the company's website, instead of using the link in the email.

What is Phish of the Week?

Phish of the Week is a weekly content initiative by Hoxhunt's Threat Operations team. Each week, we highlight a current phishing trend or notable real-world attack, covering what the threat is, how it works, and what to watch for to spot similar attacks in the future. The goal is to build consistent recognition of evolving phishing themes and tactics over time.

Comments (0)

Popular