“You’ve Won”: How to Recognize Fake Prize and Winner Phishing

Giveaway scams work because winning feels good and acting fast feels necessary. A message says you have won a phone, gift card or trip, and all you need to do is confirm a few details or pay a small fee. That is where the theft happens.

This guide shows how prize phishing campaigns are built, the technical and behavioral indicators that give them away, how to check whether a win is real, and exactly what to do if you have already clicked or paid.

It is written for consumers, with notes for security teams who field these reports.

How big the giveaway scam problem is

The FTC’s Consumer Sentinel Network Data Book 2024 (2025) recorded 97,350 reports in the “Prizes, Sweepstakes and Lotteries” category, with $351 million in reported losses and a median loss of $1,000 among people who lost money.

It was the sixth-largest fraud category by report volume.

Phishing more broadly remains the most-reported cybercrime. The FBI’s IC3 listed phishing and spoofing as the top complaint type in its 2024 report, part of 859,532 complaints and more than $16 billion in reported losses (FBI, 2025).

The APWG found that social media brands were the most-targeted sector in the fourth quarter of 2025, at 20.3% of phishing attacks, tied with SaaS/webmail (APWG Q4 2025 report, 2026).

Common types of giveaway scams

Scam type	How it reaches you	What they want
Fake winner email or text	Email or SMS claiming you won a draw	Card details for a “delivery fee”, or login credentials
Cloned social media giveaway	Lookalike brand or influencer account comments or DMs you	Clicks to a phishing page, account takeover
Free gift card offers	Ads and search results promising free store or game cards	Personal data, app installs, affiliate sign-ups
Crypto “double your coins” giveaways	Fake livestreams and posts using celebrity likeness	Crypto sent to the scammer’s wallet
Event-themed prizes	Lures tied to major sporting or shopping events	Payment card data and home address
Fake award or recognition	“You have been nominated” messages to staff	Corporate credentials and malware installs

These are not hypothetical. Palo Alto Networks researchers tracked hundreds of auto-generated domains offering free Google Play, Amazon and Roblox gift cards to harvest data.

In 2026, attackers used fake FIFA World Cup prize offers that passed email authentication checks and led to a fake reward checkout.

A workplace variant, the “Executive Award” campaign, used a fake corporate award page to steal logins and then install the Stealerium infostealer.

Anatomy of a prize phishing attack

Illustrative attack chain, based on patterns seen in the campaigns above.

1. Lure: an email, text or social media DM announces a win and includes a link. Social media scams often use a cloned account with the brand’s logo and a near-identical handle.
2. Redirect chain: the link passes through shorteners or compromised sites, sometimes with geo-filtering so security scanners see a harmless page.
3. Claim page: a branded form asks for name, address, date of birth and phone number “for delivery”.
4. Payment step: a small shipping or tax fee is charged to your card, often with hidden recurring billing.
5. Follow-on abuse: the captured card is used for further fraud, and the personal data feeds targeted phishing or account takeover.

The data harvested at step 3 is often more valuable than the fee. Subscription traps built on “mystery box” offers, for example, collect sensitive personal data alongside card numbers.

In MITRE ATT&CK terms, the lure maps to T1566 Phishing, including T1566.002 (spearphishing link) and T1566.003 (spearphishing via service, such as social media DMs).

Red flags in a fake winner email or message

Content indicators

• You must pay to collect. The FTC’s guidance on fake prize, sweepstakes and lottery scams is blunt: if you have to pay to get your prize, it is a scam. Real prizes do not require fees for “taxes” or “shipping”.
• You never entered. You cannot win a draw you did not enter.
• Urgency. “Claim within 24 hours or the prize goes to the next winner.”
• Odd payment methods. Gift cards, wire transfers, payment apps or crypto.
• Requests for bank details, ID documents or passwords to “verify” you.

Technical indicators

• Sender domain mismatch: the display name says the brand, but the address is a free webmail account or an unrelated domain.
• Lookalike links: hover (or long-press on mobile) to read the real URL. CISA’s phishing guidance flags untrusted shortened URLs and misspelled domains, and notes that perfect grammar is no longer a sign of legitimacy.
• Display-name tricks: Scammers use this trick of showing a trusted name while the underlying address or link points somewhere else, so always check the full address.
• New or unverified social accounts: few posts, recent creation date, or a handle with extra characters.

AI has made lures more convincing. YouTube warned creators about a phishing campaign that used an AI-generated deepfake video of its CEO to steal credentials. Expect polished copy, cloned voices and realistic video in giveaway scams too.

How to verify a real prize or competition

Legitimate promotions exist, and many people enter them safely. The aim is to confirm through a channel the scammer does not control.

1. Go to the source yourself. Type the brand’s website address or open its verified social account directly. Check whether the competition and the winner announcement appear there.
2. Read the terms. Genuine promotions publish rules naming the promoter, closing date and how winners are contacted.
3. Contact the promoter using contact details from its official site, not the message.
4. Never pay a fee and never share passwords or one-time codes to claim anything.
5. Use a separate email address for competition entries so prize phishing stands out and your main inbox stays cleaner.

If you enter competitions often, you may find them through listing sites; for example, this new brand aggregates promotions. Treat any listing as a pointer only, and still verify each promoter’s terms on its own official site before entering.

What to do if you clicked or paid

Illustrative response checklist.

1. Payment card entered: call your card issuer using the number on the card, block it, and dispute charges. Watch for small recurring charges.
2. Password entered: change it immediately on the real site and anywhere you reused it, then sign out other sessions. Going forward, don’t recycle passwords; a password manager makes unique passwords practical.
3. Turn on MFA for email and social media, preferably with an authenticator app or passkey.
4. Software installed: disconnect the device from the network, run a full scan with up-to-date security software, and get help if it is a work device.
5. Report it: in the US use ReportFraud.ftc.gov and IC3; also report the account or message to the platform. If personal data was taken, follow the recovery steps at IdentityTheft.gov.

Hardening your social profiles reduces the chance of a cloned-account scam reaching you in the first place. Our guide to social media security covers privacy settings, app permissions and recovery options.

Guidance for security teams

Prize lures increasingly target employees, especially through award and gift-card themes. A few practical measures help.

• Include prize and award lures in phishing simulations and awareness content, with the “pay to claim” rule as the core message.
• Monitor for lookalike domains and social accounts impersonating your brand, and request takedowns quickly.
• Enforce DMARC at p=reject on your own domains so attackers cannot send giveaway emails as you. Note that DMARC does not stop lookalike domains.
• Make reporting easy with a one-click report button and quick feedback to reporters.

These map to NIST CSF 2.0 PR.AT (awareness and training) and CIS Controls v8 Control 14 (security awareness and skills training) and Control 9 (email and web browser protections).

Key takeaways

• Giveaway scams cost US consumers $351 million in reported 2024 losses in the FTC’s prizes, sweepstakes and lotteries category.
• If you must pay, share passwords or hand over bank details to claim a prize, it is a scam.
• Check the real sender address and link destination; display names and padlocks prove nothing.
• Verify any win through the brand’s official site or verified account, never through the message.
• If you clicked or paid, contact your card issuer, change reused passwords, enable MFA and report it.

FAQ

How do I know if a giveaway is a scam?

Warning signs include winning a contest you never entered, being asked to pay a fee, pressure to act quickly, requests for passwords or bank details, and messages from accounts or domains that do not match the brand.

Can you get scammed by just clicking a giveaway link?

Clicking alone usually exposes you to a phishing page rather than immediate harm, but some links lead to malware downloads. The main damage comes from entering details or installing software, so close the page and run a scan if you downloaded anything.

Do real prize winners have to pay fees?

No. The FTC states that if you have to pay to get your prize, it is a scam. Legitimate promoters do not ask winners to pay shipping, taxes or processing fees upfront.

How do scammers run fake giveaways on Instagram or Facebook?

They create lookalike brand or influencer accounts, comment on real giveaway posts or send DMs telling users they won, then link to phishing pages that collect logins, card details or personal data.

Where do I report a fake winner email?

Use your email provider’s report phishing option, then report it to ReportFraud.ftc.gov and IC3 in the US, or your national fraud reporting service elsewhere.