Gamers who have spent months, or even years, saving up Microsoft Rewards points are facing a nasty surprise. Cybersecurity researchers have flagged a highly advanced phishing campaign specifically designed to drain these loyalty accounts. The end goal? Stealing digital Xbox gift cards before the legitimate owners even realize their accounts have been compromised.
The scam is particularly dangerous because it does not just steal passwords. It bypasses modern security barriers like multi-factor authentication (MFA) using a technique known as Adversary-in-the-Middle (AiTM) phishing. For victims, the loss is immediate, and getting those hard-earned points back from customer support can be an uphill battle.
How the Trap is Sprung
It usually starts with an urgent email. The message looks exactly like an official alert from Microsoft, claiming that the user’s Rewards points are about to expire. Other times, the bait is an offer for a free sweepstakes entry or an exclusive high-value Xbox digital gift card reward. To claim it, the user just has to click a link.
That link takes them to a fake login portal. This is where the hackers’ sophistication really shines. The page is not just a static copy of a Microsoft login screen. It is a live proxy server. When the victim enters their username and password, the fake site forwards those details to the real Microsoft server in real-time. If the victim has two-factor authentication enabled, the real Microsoft sends a code. The victim enters that code into the fake site, which passes it to the real one.
Once the login is successful, the attackers steal the session cookie. This cookie is like a digital VIP pass. It tells Microsoft the user is already authenticated. With this token in hand, the scammers can access the victim’s account from any device, completely bypassing the password and the MFA prompt.
Draining the Vault
Once inside, the thieves move fast. They head straight for the Microsoft Rewards dashboard. Many loyal users accumulate tens of thousands of points, saving them for major hardware purchases or new game releases. To the scammers, this is pure digital currency.
The hackers instantly redeem the stolen points for digital Xbox gift cards. Because these cards are delivered as digital codes via email, the scammers can change the primary contact email on the account or simply copy the codes directly from the redemption screen. Within minutes, the victim’s point balance is zeroed out, and the gift cards are either redeemed on a throwaway Xbox account or sold on the black market for cash.
What makes this attack so devastating is how quiet it is. Because the hackers use stolen session cookies, Microsoft’s automated systems often do not flag the login as suspicious. The victim might only realize what happened when they log in a day later to find their points balance wiped clean.
Protecting Your Hard-Earned Points
As these attacks grow more common, security experts are urging Microsoft Rewards members to take extra precautions. Standard MFA is better than nothing, but it is no longer foolproof against these proxy-based attacks.
Here is what you can do to keep your points safe:
- Double-check the URL: Always look closely at the address bar before typing your password. Official Microsoft login pages will always be on the “microsoft.com”, “live.com”, or “passport.net” domains. If you see strange characters or lookalike words, close the tab immediately.
- Don’t rely on email links: If you get an email saying your points are expiring, do not click the link in the message. Open your browser, type in the Microsoft Rewards URL manually, and check your status there.
- Use passkeys or physical security keys: If possible, upgrade your account security to use passkeys or hardware keys like YubiKeys. These methods are bound to the specific, legitimate domain name, meaning a phishing site cannot steal or reuse them.
- Monitor your account activity: Regularly check your Microsoft account’s sign-in history. If you see successful logins from locations you have never visited, change your password immediately and sign out of all active sessions.
For now, vigilance is the best defense. Xbox gift cards are a prime target because they are as good as cash, and Microsoft Rewards is a goldmine waiting to be tapped by clever thieves. Don’t let your gaming budget fund a hacker’s payday.
About the Author
