Fake gift card giveaways are a survey-and-subscription trap, researchers say

A free gift card from a familiar shop, advertised beside a celebrity’s name, is a well-worn lure. CTM360, a digital-risk firm, says it has now logged more than 1,000 incidents in a campaign that uses that lure at scale. The pages look like official reward portals. They do not deliver a card.

What the researchers found

In its report “The Gift Card,” CTM360 says the campaign impersonates trusted brands, including PlayStation, Google Play, Sephora, SHEIN and Walmart, and sends people to fake reward sites. There, visitors are asked to complete surveys, verification steps or subscription offers. Instead of a gift card, they risk handing over personal information, installing unwanted apps, or being signed up for paid mobile services.

A November 7 write-up on BleepingComputer, published with CTM360, adds detail from the same research:

• The operators lean on sponsored social ads, viral “giveaway” posts, and fabricated celebrity or influencer endorsements.
• Because the setup is modular, they can swap the impersonated brand, the celebrity and the domain without rebuilding the rest of the scam.
• After someone picks a card value, the site plays a progress animation and may show a partly hidden code, so the reward looks real and almost ready.
• A “security check” or “human verification” step then starts a loop of surveys, quizzes, app or extension installs, and paid mobile subscriptions billed through the phone carrier.
• Completing one task does not produce the card. It produces another task.

BleepingComputer also lists Amazon among the impersonated brands and names high-profile endorsements used as bait. The underlying finding, in both the report page and that write-up, is that the campaign’s business model is affiliate commissions, not stolen gift-card stock.

What this means for you

You did not miss a secret PlayStation or Sephora giveaway. Official brands do not hand out cards through a random sponsored post that then asks you to prove you are human by installing an app or signing up for a mobile offer.

The harm is often quieter than a drained bank account. A survey can collect enough personal information for later fraud. An unwanted app or browser extension can watch what you type. A “free” mobile subscription can show up as a recurring charge on a phone bill. None of that requires the operators to send you a real card.

This is a different lure from the fake OpenAI and SpaceX event pages we wrote about earlier this week, which tried to steal work logins. The shared idea is a polished page that borrows a trusted name.

What you can do

1. Ignore unexpected gift-card ads and giveaway posts, especially those that use a celebrity’s face or a well-known logo and ask you to claim a reward right away.
2. Do not complete “human verification,” surveys or app installs on a page you reached from an ad or a social post about a free card. Close the tab.
3. Check phone-billed subscriptions with your mobile carrier if you already tapped through, and remove any app or extension you installed during that process.
4. If you typed personal details into a survey, watch for follow-up scams that reuse those details. See how scammers use leaked data to make a message feel personal.
5. Buy gift cards only from the retailer’s own site or a shop you already trust, by typing the address yourself.

How Frame helps

Frame does not see a pop-up or a sponsored ad inside a social feed. If you think a password was typed into a fake page, change it from a clean device and sign out other sessions. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each shop its own address, so a lure that arrives at the wrong one is easier to set aside. Frame never collects or stores the leaked records themselves.

Related coverage

• Fake OpenAI and SpaceX event pages are phishing Microsoft and Google work accounts: another current campaign that builds a polished page around a trusted name, in that case to steal logins rather than to sell surveys.
• How scammers use leaked data to make phishing personal: what can happen after a survey or a form has already collected your details.

Sources

• CTM360, Gift Card Scams: Fake Rewards and Brand Impersonation
• BleepingComputer, CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands, November 7, 2026