Is this order or prize text from Coles a scam?
No. Coles is one of Australia's largest supermarket chains, and flybuys is a genuine loyalty program. That loyalty program is precisely where scammers aim: points-expiry texts, bonus-points bait and invented delivery problems, each pushing a link to a lookalike page. The good news: a few quick checks almost always tell a real Coles message from a fake.
Genuine Coles links lead to coles.com.au, flybuys.com.au — but a link can be made to look real, so don't go by the link alone. Below is how genuine Coles contact usually works, the scams commonly run in its name, the red flags that give a fake away, and an example to compare against. Got a message in front of you? Check it now for an instant verdict.
What a real Coles message looks like
Genuine messages from Coles link to coles.com.au, flybuys.com.au. Treat a link to any other address as a warning sign.
- A real points balance or order also shows when you log in to flybuys.com.au or open the Coles app yourself, so check there instead of trusting the sender name, number or link
- Coles says it will not reach out to you to request personal or banking details
- Details such as a recent purchase or a points balance can be quoted by scammers, so they don't prove a message is real; the balance in your own account does
- Coles says to check that the web address in your browser is exactly coles.com.au before entering any personal information
What a genuine Coles contact shouldn't do
- Ask you to log in or enter your flybuys card number, password or banking details on a page reached from a message; Coles says it will not reach out to request personal or banking details
- Rush you with a deadline to save points or claim a voucher; Coles says many scams specify timeframes to rush people into doing something before having time to think about it
- Ask you to share or like a Facebook post in exchange for gift cards or vouchers; Coles lists this among the requests to be wary of
- Ask you to buy gift cards or vouchers; Coles lists this among the requests to be wary of, and says only a scammer will ask for gift cards as payment
- Ask you to grant access to your computer to resolve an issue; Coles lists this among the requests to be wary of
Common Coles scams
- SMS claiming your flybuys points are about to expire and urging you to click a link to claim them before they are lost.
- Messages pretending to be from Coles offering bonus flybuys points if you enter your card details on a fake website.
- Texts stating a Coles online order has a delivery problem and directing you to a link to reschedule or pay extra fees.
Red flags to watch for
- Any SMS or email that contains a link and claims urgent action is needed to save flybuys points.
- Messages that ask you to enter your flybuys card number, password or banking details on a webpage.
- A text or email about points or an order that you can't match to anything in your Coles app or flybuys account, whatever name or number it appears to come from
- Requests to download an attachment or visit a site other than flybuys.com.au or coles.com.au to check your balance.
Coles scam examples
These composed examples show how scams impersonating Coles typically read, with the tells that give each one away. Compare them against anything you've received.
flybuys: Great news! Coles is topping up member balances today. Confirm your flybuys card number at flybuys-bonus-points[.]example to activate your bonus points.
What gives it away:
- Coles warns about messages asking customers to click a link and log in to claim 'Coles Rewards points'; a balance can be checked by logging in to flybuys.com.au or the Coles app yourself
- It asks for your flybuys card number, which is the whole point of the message
- The domain is a lookalike rather than flybuys.com.au; a link, like a sender name, isn't proof either way, so check your points in the app
Subject: Problem with your Coles online order. Dear Customer, your delivery could not be scheduled. Reschedule and pay the adjusted delivery fee at coles-delivery-reschedule[.]example or your groceries will be returned.
What gives it away:
- Generic 'Dear Customer' greeting, a common sign of a bulk phishing send
- A surprise fee payable through an emailed link is card harvesting, not delivery logistics
- The link is not coles.com.au; a genuine order issue would be visible when you log in yourself
COLES: Final notice. Your flybuys points expire tonight. Redeem immediately at coles-points-rescue[.]example or lose your full balance.
What gives it away:
- Coles warns about 'Coles Rewards points' about to expire texts that ask you to click a link and log in; an urgent points-expiry SMS with a link is a pattern to check, not to click
- 'Final notice' and 'tonight' are pressure tactics aimed at loyal shoppers who value their balance
- Your true balance is one login away at flybuys.com.au or in the Coles app, so there is no need to use the link
Not sure about your message?
Paste the suspicious Coles text or email and get an instant scam verdict, free.
How to verify a message from Coles
Coles's real website is coles.com.au and the official app is the Coles app. Reach Coles through those channels, never through the details inside a message you're unsure about.
- Do not click the link, reply, or enter your flybuys card number or password anywhere the message leads
- Open the Coles app, or type coles.com.au or flybuys.com.au into your browser yourself, and check your points balance and orders there
- Remember the shortcut: don't act on a link in a points or order message; a sender name, number or link can be faked, so check the balance in your own account
- If a claimed order or bonus does not appear inside your logged-in account, the message is fake
If you have been scammed in Coles's name
Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.
- If you entered banking or card details, call your bank immediately, block the card and ask to dispute any charges
- Change your flybuys password at flybuys.com.au straight away, plus anywhere else you reuse it, and check the account for redemptions you did not make
- If you shared identity documents, contact IDCARE (idcare.org) for free identity support
- Report the scam to Scamwatch and ReportCyber using the links below, and forward the scam SMS to 7226 so carriers can block the sender
Where to report a scam impersonating Coles
Received — or fell for — a message impersonating Coles? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Coles scam activity in 2026
Most Coles impersonation right now is really flybuys impersonation: expiring-points texts, bonus-points offers wanting your card number, and the occasional fake delivery-problem message aimed at online shoppers. Campaigns tend to surge around major sales periods and school holidays, when a grocery-related message feels routine. The structure is consistent: urgency about points or an order, then a link to a lookalike page. Coles's own scam-warning page lists fake gift card ads, 'Coles Rewards points' texts and a fraudulent website referencing Coles Best Buys, which Coles says is no longer an active part of its business. Treat a link in a points or order message as a reason to check, not to click: log in yourself and look at your balance.
Frequently asked questions
I received a text saying my flybuys points are expiring — is this a Coles scam?
Coles's scam-warning page describes messages asking customers to click a link and log in to claim 'Coles Rewards points' as a phishing site designed to collect personal details. Don't use the link; check your balance by visiting flybuys.com.au yourself or opening the Coles app.
How do I know if a Coles or flybuys message is real?
A link, a sender name or an account detail can't prove a message is real, because scammers can copy all three. Log in at flybuys.com.au yourself, or open the Coles app, and check whether the balance, order or offer in the message exists there. Coles says it will not reach out to request personal or banking details.
What should I do if I clicked a link in a fake Coles SMS?
Change your flybuys password immediately via flybuys.com.au, monitor your linked bank accounts, and report the message at scamwatch.gov.au.
What are the real Coles and flybuys websites?
Coles and flybuys use coles.com.au and flybuys.com.au. Coles warns about a fraudulent website that copies its branding, and says to check that the web address in your browser is exactly coles.com.au before entering any personal information. Type the address yourself or use the official Coles app instead of following message links.
How do I report a Coles or flybuys scam?
Report it to Scamwatch (scamwatch.gov.au) so the National Anti-Scam Centre can track the campaign, and forward the scam SMS to 7226 (spells SCAM) so carriers can block the sender. If you lost money or entered card details, call your bank first and also report it to ReportCyber at cyber.gov.au.
Scam message examples
Related scam types
Scams impersonating Coles usually fit one of these patterns. Learn how each works:
Related brands
Other retail names scammers impersonate — check a message from one:
Sources
- Text or SMS scams (Scamwatch (National Anti-Scam Centre))
- Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
- Protect yourself from Scams (Coles)
This guide is general information, not legal or financial advice — always verify with Coles through an official channel.