Is this order or prize text from Woolworths a scam?
No. Woolworths is Australia's biggest supermarket chain and its Everyday Rewards program is genuine. That familiarity is exactly what scammers borrow: points-expiry texts, gift-card win emails and fake delivery notices in the Woolies name are among the most common retail phishing lures Australians receive. The good news: a few quick checks almost always tell a real Woolworths message from a fake.
Genuine Woolworths links lead to woolworths.com.au, everydayrewards.com.au — but a link can be made to look real, so don't go by the link alone. Below is exactly what a real Woolworths message looks like, the scams currently circulating in its name, the red flags that give a fake away, and a real example to compare against. Got a message in front of you? Check it now for an instant verdict.
What a real Woolworths message looks like
Genuine messages from Woolworths link to woolworths.com.au, everydayrewards.com.au. Treat a link to any other address as a warning sign.
- Woolworths and Everyday Rewards communications are sent only from woolworths.com.au or everydayrewards.com.au addresses when using email.
- Everyday Rewards balance and expiry updates appear inside the Woolworths app or after you log in at woolworths.com.au — never as a surprise SMS link.
- Woolworths never asks members to click a link to claim points or confirm account details.
- Promotional emails about gift cards or competitions come only after an in-store purchase or through the official app inbox.
- Any SMS from Woolworths will show the sender as a short code or the store name, never a random mobile number.
What Woolworths will never do
- Ask members to click a link to claim points or confirm account details
- Send Everyday Rewards balance or expiry updates as a surprise SMS link; they appear inside the Woolworths app or after you log in at woolworths.com.au
- Email you from any address outside woolworths.com.au or everydayrewards.com.au
- Send SMS from a random mobile number
- Ask for your card number, password or a payment to release points, a gift card or a delivery; no legitimate supermarket collects details that way
Common Woolworths scams
- SMS claiming your Everyday Rewards points are about to expire and directing you to click an insecure link to redeem them.
- Email or text announcing you have won a Woolworths gift card and asking you to enter card details on a fake login page.
- Messages pretending to be from Woolies about a delivery or click-and-collect order that contains a link to track or pay a fee.
Red flags to watch for
- Any link in an Everyday Rewards message that does not start with woolworths.com.au or everydayrewards.com.au.
- Urgent language about points disappearing today or a gift card expiring in 24 hours.
- Requests to enter your Everyday Rewards card number or password on a web page reached via the message.
- Sender address that uses woolworths-secure-login[.]example, everydayrewards-update[.]example or similar lookalike domains.
Woolworths scam examples
These composed examples show how scams impersonating Woolworths typically read, with the tells that give each one away. Compare them against anything you've received.
Everyday Rewards: 3,120 points on your card lapse at 11:59pm tonight. Redeem them before they reset: rewards-balance-save[.]example
What gives it away:
- Points and expiry updates appear inside the Woolworths app or after you log in yourself; they never arrive as a surprise SMS link
- The link starts with neither woolworths.com.au nor everydayrewards.com.au, which by itself settles it
- A tonight-only deadline on your 'balance' is designed to make you log in through the fake page before checking the app
Subject: Woolies is saying thanks! Dear Shopper, you have been picked from this week's checkout customers to receive a $250 Woolworths eGift Card. Enter your Everyday Rewards number and card details to verify eligibility at woolies-thankyou[.]example.
What gives it away:
- It asks for your payment card details to 'verify' a free gift; no legitimate supermarket needs your card number to give you a gift card
- The sender is not a woolworths.com.au or everydayrewards.com.au address and the greeting is generic 'Dear Shopper'
- Genuine gift-card promotions come after an in-store purchase or through the app inbox, not as a cold email with a claim link
Woolworths: your grocery delivery is on hold. Confirm your address and settle a $1.95 rebooking charge at woolies-delivery-fix[.]example to receive it today.
What gives it away:
- Real order updates live in the Woolworths app and your logged-in account, not behind a link demanding a card payment
- The tiny 'rebooking charge' is the classic pretext for harvesting your full card details
- The sender is a random number, and Woolworths SMS show a short code or the store name
Not sure about your message?
Paste the suspicious Woolworths text or email and get an instant scam verdict, free.
How to verify a message from Woolworths
Woolworths's real website is woolworths.com.au and the official app is the Woolworths app. Reach Woolworths through those channels, never through the details inside a message you're unsure about.
- Do not tap the link or enter your Everyday Rewards number, password or card details
- Open the Woolworths app, or type woolworths.com.au or everydayrewards.com.au into your browser yourself, and check your points balance, orders and messages there
- If the message mentions a delivery, check the order status inside your logged-in account rather than through any link
- Judge the link, not the logo: anything that does not start with woolworths.com.au or everydayrewards.com.au is fake
If you have been scammed in Woolworths's name
Clicked the link, paid, or shared details? Act now. The first hour matters more than anything else you do later.
- If you entered card details or paid a fee, call your bank immediately to block the card and dispute the charges
- Change your Woolworths and Everyday Rewards password by going to woolworths.com.au yourself, and change it on any other account that shares it
- Check your Everyday Rewards account for points redemptions or detail changes you did not make
- If identity documents were shared, contact IDCARE (idcare.org) for free identity support
- Report the scam to Scamwatch and ReportCyber using the links below, and forward the scam SMS to 7226 so carriers can block the sender
Where to report a scam impersonating Woolworths
Received — or fell for — a message impersonating Woolworths? Report it. It helps authorities and carriers shut the campaign down for everyone who gets the next one.
- Scamwatch — Report the scam to the ACCC's national scam service.
- ReportCyber — Report cybercrime and financial loss to the police.
- ACMA — Complain about scam texts and spam SMS, email or calls.
- Forward to 7226 (SCAM) — Forward the scam SMS to short code 7226 so carriers can block the source.
- IDCARE — Free identity and cyber support if your details were taken.
Latest Woolworths scams in 2026
Because so many households hold an Everyday Rewards card, points-expiry texts remain the workhorse of Woolworths impersonation: a lapsing balance, a tonight deadline, and a link to a fake login. Around them rotate gift-card 'thank you' emails that ask for card details to verify a free prize, and delivery or click-and-collect texts that hold an order behind a small rebooking fee. Campaigns intensify around grocery-heavy periods like Christmas. The unchanging tell is the destination: anything not starting with woolworths.com.au or everydayrewards.com.au. Check your points and orders only inside the Woolworths app, and the expiry threat loses all its power.
Frequently asked questions
I got a text from Woolworths about Everyday Rewards points expiring — is it a scam?
If the message contains a link, treat it as a scam. Check your real balance only by logging into the Woolworths app or at woolworths.com.au.
How do I know if a Woolworths email about a gift card win is real?
Genuine Woolworths gift-card promotions never ask you to click a link to claim. Log into woolworths.com.au or the app to verify any prize.
Woolies SMS with a link to update my details — safe to click?
No. Woolworths will never send a link asking you to update personal or card details. Visit woolworths.com.au manually instead.
Where can I report a fake Woolworths message?
Forward the message to Scamwatch at scamwatch.gov.au or ReportCyber at cyber.gov.au so authorities can track the campaign.
What are Woolworths' real websites?
Woolworths' official websites are woolworths.com.au and everydayrewards.com.au, and the Woolworths app is the official app. Emails come only from those domains, and any link that starts with anything else is fake. Type the address yourself whenever you want to check points, orders or gift cards.
What should I do if I entered my Everyday Rewards details on a fake page?
Change your password straight away by going to woolworths.com.au yourself, and check your Everyday Rewards account for redemptions you did not make. If you also entered card details, call your bank to block the card. Then report the scam to Scamwatch (scamwatch.gov.au) and forward the SMS to 7226 (spells SCAM).
Related scam types
Scams impersonating Woolworths usually fit one of these patterns. Learn how each works:
Related brands
Other retail names scammers impersonate — check a message from one:
Sources
- Text or SMS scams (Scamwatch (National Anti-Scam Centre))
- Phishing scams: how scammers pose as trusted organisations (Scamwatch (National Anti-Scam Centre))
- Report a scam (Scamwatch (National Anti-Scam Centre))
This guide is general information, not legal or financial advice — always verify with Woolworths through an official channel.