Overview
Threat intelligence firm CTM360 published a report on 7 November 2026 describing a global campaign of fake gift card giveaways that impersonate well-known brands and celebrities. The company identified more than 1,000 incidents tied to the recurring campaign. BleepingComputer carried the report as a sponsored post.
Impersonated brands include PlayStation, Sephora, SHEIN, Walmart, and Amazon. The ads lean on celebrity endorsements, with names such as MrBeast and Alix Earle used as lures, and are distributed mainly through social media.
How the Scam Works
- Lure — A sponsored ad or social post promises a free gift card.
- Fake reward portal — Victims land on a page with cloned brand logos and colors, fake participant counts, live countdown timers, and fabricated testimonials.
- Scripted generation — After choosing a card value, an animation pretends to generate the card.
- "Human verification" gate — Victims are sent to surveys, app installs, or paid mobile subscriptions billed through their carrier.
- Endless loop — The portal reports the step as "incomplete" and pushes the victim to another offer.
CTM360 says no reward was delivered in any of the flows it tested.
Affiliate Monetization, Not Classic Phishing
Unlike credential phishing, the operators here get paid through affiliate networks. When a victim submits a phone number and confirms a PIN or one-time code, the operator earns a commission, tracked through URL parameters such as offer_id and aff_id. CTM360 characterizes the activity as affiliate monetization schemes. The victim's cost shows up as unwanted recurring subscriptions and exposure of personal data.
Defensive Guidance
For consumers and staff
- Legitimate brands do not hand out high-value gift cards behind mandatory surveys, app installs, or phone number verification.
- Never enter a phone number or one-time code on a giveaway site.
- Check your mobile bill for unfamiliar premium or carrier-billed subscriptions, and ask your carrier to block third-party billing if unneeded.
For brand protection and security teams
- Monitor social platforms and ad networks for unauthorized sponsored ads and fake celebrity giveaway posts using your brand.
- Report and take down lookalike reward portals and the associated ad accounts.
- Include gift card scam scenarios in security awareness training.