Vodafone scam: "7415 Gold Starter points will expire today"

Vodafone scam September 2026: "Your 7415 Gold Starter points expire today." #

Your 7415 Vodafone Gold Starter points expire today. Visit: ***https://cutt.ly/voda-info ***for more information and to redeem your points.”

Did you receive a text message saying your 7.415 Vodafone Gold Starter points are about to expire? It's a scam , not from Vodafone—and Vodafone itself confirmed it today, September 9th. We'll explain in two minutes how to recognize it and what to do if you've already clicked.

Updated September 9, 2026: A smishing campaign using the Vodafone name is circulating, promising fake expiring loyalty points.

The scam in brief #

In September 2026, an SMS is circulating announcing the alleged expiration of 7.415 "Vodafone Gold Starter" points . The message contains a shortened link to a page outside the official Vodafone domain ( store-voda.store ), which displays a fake rewards catalog. The link ends with a request for payment card details for a fake shipping charge. The points are not real, and the message does not originate from Vodafone.

First of all: three words you will use often from now on #

Before we get into the details, let's clarify three terms you'll hear more and more often when talking about online scams, because we'll be using them in this article too:

• PhishingThis is a scam in which someone pretends to be a trusted company or individual (a bank, a courier, a telephone operator) to convince you to enter your personal information on a fake website. The name comes from the English word "pescare" (fishing): they throw you bait and wait for you to bite.
• Smishing: This is simply phishing done via SMS instead of email. “Smishing” comes from SMS + phishing.
• CardingThis is the unauthorized use of stolen payment card information—either to make purchases in your name or to resell that information to other criminals. In practice, if you fall victim to carding, you risk having your card used for payments you didn't authorize, or having your information leaked to other scammers.

This scam combines all three: it arrives as a smishing scam, takes you to a phishing site, and aims to card your data.

The reason it feels so real: It comes to the right place #

The most confusing detail for those who receive this SMS is that it arrives in the same conversation where you usually receive real messages from Vodafone —like the notification that your plan has been renewed. Same name above the chat, same icon. At first glance, it looks identical to the others.

This, however, isn't proof that it's true. It's called sender spoofing : when you send a text message, you can choose to have any name appear as the sender instead of a phone number. This exists for legitimate reasons (it's how companies send you real notifications), but there's no system to verify that the person who writes "Vodafone" is actually Vodafone. Your phone sees the same name and places the message in the same chat, without any verification.

So, just because a message is "in the right chat" doesn't mean anything. Anyone can use whatever name they want as the sender.

The first clue that something isn't right: the stitches change #

The text message says you have 7415 points . But if you open the link, the page that loads shows 7350 . A different number than the one written in the text message just moments before.

In a real system, your points balance is always the same, no matter where you check it. If two screens show different numbers for the same thing, that's already a clear sign you're not looking at something real—they're probably automatically and randomly generated, with no real connection to an account.

“Vodafone Gold Starter” is not a real program #

Vodafone's real points program is called Vodafone Happy , and you can only find it through the official My Vodafone app or on the website happy.vodafone.it.

“Vodafone Gold Starter” is a name that does not appear among the official Vodafone loyalty programs — it was invented on purpose to seem credible, since it contains the word “Vodafone” and sounds like something premium (“Gold”).

Why does it say “they expire today”? #

This isn't a coincidence. It's a very common psychological technique in these scams: making you believe you have very little time to act, so you don't stop to check carefully before clicking.

The reasoning they want you to make is: “I have points, they're about to expire, I have to hurry.” And the faster you hurry, the less you check the details—which are precisely what unmasks the scam.

What you find by clicking on the link #

The link takes you to a site called store-voda.store/it — please note: it's not vodafone.it . It's a different domain, created to appear to be related to Vodafone (it contains "voda"), but it has nothing to do with the real company.

On this page you'll find a catalog of authentic and recognizable products, each with a different point cost:

• AirPods Pro 2 and AirPods 3
• Portable air conditioners (including a 9.000 BTU SereneLife model and a 14.000 BTU Costway)
• Lavazza coffee machines (Jolie Evo, Deséa White Cream)
• Travel backpack, portable fan and other accessories

Each product has a point price that’s carefully crafted to appear affordable compared to the displayed balance—close enough that you’ll want to choose a reward right away before you “waste” your points, rather than stopping to check if the site is legitimate.

Why they use a “shortened” link #

The link in the SMS isn't directly store-voda.store, but goes through cutt.ly , a service that converts a long address into a short one. Cutt.ly itself is a legitimate service, commonly used by many people and companies for legitimate reasons.

The problem is how it's used here: it hides at a glance where it's actually taking you . If the link were written out in full, you'd immediately see "store-voda.store" and realize it's not Vodafone. By shortening it, this detail disappears.

Rule of thumb : If a company sends you a text message with a shortened link instead of their real address, that's already reason to be suspicious.

The real goal: to make you pay for shipping #

After choosing a prize, the site asks you to enter your card details to pay for shipping — with two options, just to make it seem like a real store:

• €4,90 for delivery in 5/7 working days
• €10 for fastest delivery, 1-2 working days

But the reward doesn't exist, and it never will. What's really happening is that by entering your card number, expiration date, and security code, you're handing over this data directly to the site's creator—ready to be used to make purchases at your expense, or resold to other scammers (the "carding" we discussed earlier).

This type of scam is called an “advance payment scam” : they trick you into believing you have to pay a small amount to receive something much larger — that small amount (or rather, the card details used to pay it) is all the scammers really want.

Why sometimes the site doesn't open #

Some people have noticed that the same link, opened at different times or on different phones, sometimes displays the site normally and other times gives an error or doesn't load at all.

This could be due to a technique called cloaking —literally, "masking": some scam sites are programmed to show themselves only to certain people and hide from anyone who appears to be a security check or an investigator. We say "could" because without a thorough technical check, we can't say with 100% certainty—but it's typical behavior on many sites of this type, and there are a few ways it's technically done:

• Device recognition: The site checks whether you are coming from a real phone (with a regular mobile browser) or from an automated security analysis tool, and displays different content in each case.
• Check how you got to the linkSome sites only allow you to open the link by clicking it directly from the SMS, and not if you open it “cold” by copying it elsewhere.
• Link tied to a unique codeThese short links often contain a code that the site associates with a single recipient. If someone other than the recipient of the specific SMS opens it, the site may return an error, as if the "ticket" has already been used or isn't yours.
• Block by geographic area: The site may only accept visits from those connecting from Italy or from certain telephone operators, blocking the rest.

In practice, all these techniques serve the same purpose: making it harder for investigators (security researchers, spam filters, companies that block scam sites) to analyze the site and have it shut down, while continuing to regularly target those who click on the original message. The fact that the site opens "just for you" is therefore not proof that it is legitimate —in fact, it is consistent with the behavior of many similar sites.

How to recognize it in seconds, next time #

• The sender says “Vodafone”, but this doesn't prove anything — can be easily forged.
• The link does not lead to vodafone.it, but at a different address (here: store-voda.store).
• The name of the program, “Gold Starter,” does not exist.
• The number of points changes between SMS and website.
• They ask you the card data for a “free” prize.

The simultaneous presence of multiple signals like these makes the message highly suspicious and, in this case, allows the campaign to be identified as fraudulent.

I opened the link but didn't write anything: am I in trouble? #

No, not necessarily. If you simply opened the page, without entering data, making payments, or downloading files, the risk is generally much lower. Close the page and do not interact further with the site. The real danger begins when you enter actual data on the page.

I entered something: what do I do now? #

If you only wrote your name, address, or phone number : This isn't the worst thing, but keep your eyes peeled — you may receive more targeted scams, built using this information to appear even more credible.

If you entered a password (for an account or service) : change it immediately, and change it everywhere else you use it. If you can, enable two-step verification for the affected account—it's a second code sent to you via SMS or app, in addition to your password, and it makes it much more difficult for someone who has stolen your password to break into your account.

If you entered your card details :

1. Call your bank immediately (the number is usually written on the back of the card) and ask them to block it.
2. Check your latest transactions and report any expenses you don't recognize.
3. Get a new card, with a different number.
4. Keep a screenshot of the text message and the website; it may be useful if you file a complaint.

A helpful general tip: if you've enabled push or SMS notifications from your bank for payments, you'll receive an alert every time your card is used, even for a small amount. If you notice a charge you don't recognize, even for a few euros, don't ignore it—fraudsters often make a test micropayment first before using your details for larger amounts.

In any case : if you want to check your real Vodafone points, open the My Vodafone app directly; never follow the link in a text message. For assistance, call 190 (toll-free from a Vodafone number) or 800 100 195 (from other operators or a landline).

For those who know a little about cybersecurity: a technical summary #

This section summarizes the campaign using the terminology commonly used in threat intelligence, for those who work in the sector or want to delve deeper beyond the popular explanation.

Attack type : smishing → phishing → advance-fee fraud / carding. The fake loyalty program acts as a lure to draw the victim into the payment data collection stage.

Initial vector : SMS with spoofed alphanumeric sender ID (“Vodafone”). The field is not authenticated on the receiving end, so the client groups the message into the existing thread based on the declared name alone — there is no cryptographic or provenance verification equivalent to SPF/DKIM/DMARC as is done (when configured) for email.

Payload delivery : URL shortener (cutt.ly) as an intermediate hop, with a redirect to a combosquatting domain (contains the "voda" branding without matching the official vodafone.it domain). The use of the shortener serves both to obfuscate the final destination and, potentially, to collect click metrics before the redirect.

Landing page : Real product catalogs used as social proof to increase conversion rates. Inconsistency detected between the value communicated via SMS and that displayed on the client side (7415 vs. 7350), indicating the absence of a real persistent backend or independent generation of values ​​between the two touchpoints.

Observed anomalous behavior : non-deterministic landing page access between different requests. Compatible hypotheses, in order of plausibility in the context of similar smishing campaigns:

• device/user-agent fingerprinting, with content served conditionally
• referrer check (access granted only if the referrer is consistent with an SMS client)
• Single-use token embedded in the short link, associated with the single recipient
• geofencing on IP/ASN or on the range of Italian mobile operators

Passive verification performed : DNS resolution for the domain was confirmed to be consistent across multiple public resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9), all of which agreed on a single A record. The domain appears to be served behind Cloudflare as the DNS provider, with an nginx backend. HTTP/HTTPS requests to the resolved IP, with SNI and Host headers consistent with the domain, consistently returned 404s across multiple paths tested, even replicating typical mobile browser headers and forcing TLS/ALPN negotiation. The observed behavior therefore does not depend on SNI, Host headers, or basic application headers: the difference between the “working” access from a smartphone and the 404 observed from a different network/toolchain remains plausibly tied to higher-level signals (client fingerprint, network origin, or a token tied to the single link sent via SMS), but it has not been isolated with certainty—and, for obvious ethical and legal reasons, we did not push the passive analysis further on a third-party infrastructure used for fraudulent activity.

None of the cloaking hypotheses have thus been definitively confirmed — they remain plausible hypotheses based on known patterns, not 100% verified IOCs.

IOCs collected :

• Initial URL: cutt[.]ly/voda-info
• Target domain: store-voda[.]store
• Theme of the lure: fake loyalty program "Vodafone Gold Starter"

TTPs observed : sender ID spoofing, combosquatting, social proof via real product catalog, urgency-based social engineering, advance-fee fraud in the final stage.

To be remembered, more than any other detail #

There's no need to memorize all the tricks of this particular scam—they'll invent more tomorrow, perhaps posing as your bank or a courier. The only really useful thing you can take home is this:

To check anything about your account—points, offers, payments—always open the app or official website yourself, entering the address yourself. Never follow a link sent to you in a message, even if it appears to be written by someone you claim to be.

If you want to better understand how these scams work in general, even on a slightly more technical level, we also talk about them in the articles on what phishing is and how to recognize it and on the psychological manipulation techniques used online.

If you've received a similar text message and have any questions, or just want confirmation before clicking anything, you can email us at info@hackita.it : we'll be happy to answer; better one more question than a problem later.

FAQ #

Is this SMS really a scam? Yes. The program mentioned doesn't exist, the link hides the real site, and at the end, they ask for your credit card details for a prize that will never arrive.

Vodafone 7415 points scam: is it true? No, it's not true. It's a scam: the number "7415 points" is made up, as is the name of the program "Gold Starter."

7415 Vodafone Gold Starter points—what are they? They're not real points. It's the number used in a scam SMS to make you believe you have an expiring reward to redeem on a fake website.

Vodafone SMS points expire today, right? In this campaign, the shortened link leads to a domain that doesn't belong to Vodafone. To check for any communications or benefits, always go directly to official Vodafone channels—the My Vodafone app or happy.vodafone.it—rather than following the link received.

Does "Vodafone Gold Starter" really exist? No, it's not a real Vodafone loyalty program. The real one is called Vodafone Happy.

Is Cutt.ly a dangerous site? No, it's a legitimate and honest link shortening service. The problem isn't the service itself, but the fact that it's being used here to hide an unofficial domain.

I'm not even a Vodafone customer. Why did I receive this text message? Because these messages are sent en masse to lists of phone numbers, without knowing who is actually a Vodafone customer and who isn't. Receiving it even though you're not a customer is, in fact, another clue that it's a scam.

Why did it arrive in the same chat as the real Vodafone messages? Because the name that appears as the sender of an SMS can be freely chosen by the sender, without any checks. The phone groups messages only by the name written, not by the actual sender.

Is store-voda.store a Vodafone website? No. It's a different domain, created to appear to be related to Vodafone but with no real connection to the company.

If I just open the link without typing anything, am I at risk? No, opening a page and closing it doesn't expose you to any real risk. The danger only begins if you enter real data.

What does "carding" mean? It's the illicit use of stolen card details to make purchases or resell them to other criminals. This is the ultimate goal of this scam.

How do I check my real Vodafone points? Only through the official My Vodafone app or the happy.vodafone.it website, never through a link received via SMS.

I've already entered my card details, what should I do now? Call your bank immediately to block the card, check recent transactions, and report anything you don't recognize.