Is this order or prize text from Woolworths a scam?
No. Woolworths is Australia's biggest supermarket chain and its Everyday Rewards program is genuine. That familiarity is exactly what scammers borrow: points-expiry texts, gift-card win emails and fake delivery notices in the Woolies name are lures to watch for. The good news: a few quick checks almost always tell a real Woolworths message from a fake.
Genuine Woolworths links lead to woolworths.com.au, everydayrewards.com.au — but a link can be made to look real, so don't go by the link alone. Below is how genuine Woolworths contact usually works, the scams commonly run in its name, the red flags that give a fake away, and an example to compare against. Got a message in front of you? Check it now for an instant verdict.
What a real Woolworths message looks like
Genuine messages from Woolworths link to woolworths.com.au, everydayrewards.com.au. Treat a link to any other address as a warning sign.
- Everyday Rewards balances, expiry dates and orders can be checked in the Woolworths app or after you log in at woolworths.com.au yourself, so check there instead of trusting the sender name, number or link
- Woolworths says its team members will not contact you asking for your password or One-Time-Login codes in order to login to your account
- Woolworths says its team members will not request remote access to your computer or mobile phone, or ask you to install software
- Woolworths says scams are designed to look authentic, copying features from its branding, such as its logo and colour scheme, so a familiar look proves nothing
- Woolworths says the differences in a fake web address can be very subtle, and advises typing the correct URL into your web browser yourself
What a genuine Woolworths contact shouldn't do
- Ask you for your password or a One-Time-Login code; Woolworths says its team members will not
- Ask for remote access to your computer or phone, or ask you to install software; Woolworths says its team members will not
- Rush you with a deadline; Woolworths says scam messages often create a sense of urgency by attempting to rush, scare or entice you
- Send you to a link to claim points or confirm account details; check Everyday Rewards points and orders inside the Woolworths app or your logged-in account instead
- Ask for your card number, password or a payment to release points, a gift card or a delivery; no legitimate supermarket collects details that way
Common Woolworths scams
- SMS claiming your Everyday Rewards points are about to expire and directing you to click an insecure link to redeem them.
- Email or text announcing you have won a Woolworths gift card and asking you to enter card details on a fake login page.
- Messages pretending to be from Woolies about a delivery or click-and-collect order that contains a link to track or pay a fee.
Red flags to watch for
- A link in an Everyday Rewards message that looks like a Woolworths or Everyday Rewards address but has extra words, odd spelling or a different ending; Woolworths says the differences in a fake address can be very subtle
- Urgent language about points disappearing today or a gift card expiring in 24 hours.
- Requests to enter your Everyday Rewards card number or password on a web page reached via the message.
- Sender address that uses woolworths-secure-login[.]example, everydayrewards-update[.]example or similar lookalike domains.
Woolworths scam examples
These composed examples show how scams impersonating Woolworths typically read, with the tells that give each one away. Compare them against anything you've received.
Everyday Rewards: 3,120 points on your card lapse at 11:59pm tonight. Redeem them before they reset: rewards-balance-save[.]example
What gives it away:
- Your points balance can be checked in the Woolworths app or after you log in yourself, so an SMS link isn't needed; Woolworths says SMS scams often encourage you to tap a link to verify details or claim a prize
- The link goes to a lookalike address; Woolworths says the differences in a fake address can be very subtle, so check in the app rather than judging by the link
- A tonight-only deadline on your 'balance' is designed to make you log in through the fake page before checking the app
Subject: Woolies is saying thanks! Dear Shopper, you have been picked from this week's checkout customers to receive a $250 Woolworths eGift Card. Enter your Everyday Rewards number and card details to verify eligibility at woolies-thankyou[.]example.
What gives it away:
- It asks for your payment card details to 'verify' a free gift; no legitimate supermarket needs your card number to give you a gift card
- The greeting is a generic 'Dear Shopper'; a familiar-looking sender address doesn't prove an email is real, because addresses can be faked
- A prize you didn't enter, claimed through a link in an unsolicited email, is the giveaway pattern; check the Woolworths app instead
Woolworths: your grocery delivery is on hold. Confirm your address and settle a $1.95 rebooking charge at woolies-delivery-fix[.]example to receive it today.
What gives it away:
- An order update can be checked in the Woolworths app or your logged-in account without paying through a link
- The tiny 'rebooking charge' is the classic pretext for harvesting your full card details
- A sender name or number can't show a text is real, because scammers can fake both; check the order inside the Woolworths app
Not sure about your message?
Paste the suspicious Woolworths text or email and get an instant scam verdict, free.
How to verify a message from Woolworths
Woolworths's real website is woolworths.com.au and the official app is the Woolworths app. Reach Woolworths through those channels, never through the details inside a message you're unsure about.
- Do not tap the link or enter your Everyday Rewards number, password or card details
- Open the Woolworths app, or type woolworths.com.au or everydayrewards.com.au into your browser yourself, and check your points balance, orders and messages there
- If the message mentions a delivery, check the order status inside your logged-in account rather than through any link
- Judge what the message asks you to do, not the logo or the link: Woolworths says scams copy its logo and colour scheme and that fake addresses can differ only subtly, so check in the app
If you have been scammed in Woolworths's name
Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.
- If you entered card details or paid a fee, call your bank immediately to block the card and dispute the charges
- Change your Woolworths and Everyday Rewards password by going to woolworths.com.au yourself, and change it on any other account that shares it
- Check your Everyday Rewards account for points redemptions or detail changes you did not make
- If identity documents were shared, contact IDCARE (idcare.org) for free identity support
- Report the scam to Scamwatch and ReportCyber using the links below, and forward the scam SMS to 7226 so carriers can block the sender
Where to report a scam impersonating Woolworths
Received — or fell for — a message impersonating Woolworths? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Woolworths scam activity in 2026
Because so many households hold an Everyday Rewards card, points-expiry texts remain the workhorse of Woolworths impersonation: a lapsing balance, a tonight deadline, and a link to a fake login. Around them rotate gift-card 'thank you' emails that ask for card details to verify a free prize, and delivery or click-and-collect texts that hold an order behind a small rebooking fee. Campaigns intensify around grocery-heavy periods like Christmas. The common tell is the ask: act through a link, on a deadline. Woolworths says fake addresses can differ only subtly, so check your points and orders inside the Woolworths app and the expiry threat loses its power.
Frequently asked questions
I got a text from Woolworths about Everyday Rewards points expiring — is it a scam?
Don't use the link. Woolworths says SMS scams are often crafted to look like they are from a legitimate organisation and encourage you to verify your details to claim a prize by tapping a link. Check your real balance by logging into the Woolworths app or typing woolworths.com.au yourself.
How do I know if a Woolworths email about a gift card win is real?
Don't use the link. Woolworths says scammers direct people to fake shopping sites through social media posts promoting free giveaways or special offers, and that products are often advertised as free, often after a short survey, with only a small shipping fee payable. Log into woolworths.com.au or the app to check any prize.
Woolies SMS with a link to update my details — safe to click?
Don't tap it. Woolworths says to be suspicious of messages that contain instructions to click a link, create a sense of urgency or request sensitive, personal or financial information. Visit woolworths.com.au yourself instead.
Where can I report a fake Woolworths message?
Forward the message to Scamwatch at scamwatch.gov.au or ReportCyber at cyber.gov.au so authorities can track the campaign.
What are Woolworths' real websites?
Woolworths' official websites are woolworths.com.au and everydayrewards.com.au, and the Woolworths app is the official app. Woolworths says to type the correct URL into your browser yourself and that a fake address can differ only subtly, so don't judge an email by its sender address or logo, which scammers can copy. Type the address yourself whenever you want to check points, orders or gift cards.
What should I do if I entered my Everyday Rewards details on a fake page?
Change your password straight away by going to woolworths.com.au yourself, and check your Everyday Rewards account for redemptions you did not make. If you also entered card details, call your bank to block the card. Then report the scam to Scamwatch (scamwatch.gov.au) and forward the SMS to 7226 (spells SCAM).
Scam message examples
Related scam types
Scams impersonating Woolworths usually fit one of these patterns. Learn how each works:
Related brands
Other retail names scammers impersonate — check a message from one:
Sources
- Text or SMS scams (Scamwatch (National Anti-Scam Centre))
- Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
- Report a scam (Scamwatch (National Anti-Scam Centre))
- Scam Alerts (Woolworths)
This guide is general information, not legal or financial advice — always verify with Woolworths through an official channel.