Fraudulent reward portals and fake gift card giveaways are spreading worldwide, using trusted brands, celebrity endorsements and deceptive “human verification” checks to trap users in endless offer loops. According to CTM360, these campaigns do not provide gift cards; instead, they collect personal information, drive application installs and generate commissions from recurring mobile subscriptions.
Read the full report here: CTM360 gift card scam report
More than 1,000 incidents impersonating trusted brands
CTM360 analysts have identified more than 1,000 incidents connected to this recurring campaign. Threat actors exploit consumers’ familiarity with major retailers and online platforms by impersonating brands including PlayStation, Sephora, SHEIN, Walmart and Amazon.
The campaigns are distributed heavily through social media, including:
- Sponsored social media advertisements
- Viral posts promoting fake giveaways
- Fabricated endorsements from celebrities and influencers such as MrBeast and Alix Earle
The underlying infrastructure is modular. Attackers can change the impersonated brand, celebrity lure and domain name without rebuilding the core fraud system.
How fake gift card generation works
CTM360 describes the activity as a structured fraud lifecycle designed to move victims from curiosity to trust and, ultimately, urgency.
After clicking a malicious advertisement, users are redirected to a fraudulent reward portal. These websites are designed to look credible through the use of:
- Cloned brand logos and color schemes
- Fake participant counts and live countdown timers
- Fabricated testimonials from “recent winners”
When a victim chooses a gift card amount, the site displays a scripted animation that simulates the generation of a reward. It then shows a partially masked code, such as XXXX-XXXX-7F3A-XXXX, to make the gift card appear genuine and immediately claimable.
Before revealing the full code, the portal presents a deceptive “security check” or “human verification” requirement.
Discover how threat actors exploit brand impersonation and fake rewards. Gain insight into attacker infrastructure and learn how to defend your organization with CTM360’s digital risk protection.
Infinite verification loops generate revenue
CTM360 identifies the fake “Human Verification” process as “Trap 10.” Rather than carrying out a legitimate security check, it redirects victims to third-party activities that generate revenue for the campaign operators.
Victims may be instructed to:
- Complete surveys, quizzes and promotional offers
- Install unnecessary third-party applications or browser extensions
- Subscribe to paid mobile services through local carrier-billing systems
Completing these tasks does not unlock a gift card. The portal reports each step as “incomplete” and sends the victim to another offer. CTM360 said that no rewards were delivered in any of the flows it tested.
Affiliate tracking connects victims to threat actors
Unlike conventional phishing campaigns that primarily target account credentials, this operation relies on volume and affiliate conversions.
CTM360 observed decoy pages redirecting victims through affiliate tracking URLs containing parameters such as offer_id and aff_id. These tracking tokens associate a victim’s registration with the threat actor’s affiliate network account.
After a victim submits a mobile number and completes the PIN or one-time password verification for a subscription, the threat actor receives a commission.
Risks for users and businesses
The consequences for victims extend beyond wasted time. They can include the exposure of personal information, unexpected mobile phone charges and an influx of spam.
Organizations also face reputational damage when criminals abuse their brands in fake giveaways. The campaign reflects a broader trend in which attackers operate at scale and weaponize brand trust to drive profitable affiliate conversions.
Detect cyber threats 24/7 with CTM360. Monitor, analyze and quickly mitigate risks across your external digital environment.
Sponsored and written by CTM360.
Source: www.bleepingcomputer.com