Fake Gift Card Giveaways Can Add Charges to Phone Bills

Fake gift card giveaways are sending people through bogus verification steps that collect personal information, promote app downloads and may enroll phones in recurring paid subscriptions. The polished sites impersonate familiar retailers and entertainment brands, so families should treat unexpected offers of free gift cards as scams.

What happened

According to BleepingComputer, CTM360 identified more than 1,000 incidents connected to a recurring campaign built around fake rewards. The scams have impersonated brands including Amazon, Walmart, PlayStation, Sephora and SHEIN.

A victim typically reaches a fraudulent reward page after clicking an ad, often distributed through social media. The page may use convincing branding, promotional messages and fake progress indicators. After the visitor chooses a gift card amount, an animation appears to generate the card, followed by a partly hidden code that makes the reward look ready.

The site then demands a “security check” or “human verification.” Instead of confirming anything, that step sends the visitor into repeated third-party offers, surveys, registrations or app installations. Completing one task does not unlock the gift card; the site reports that the task is unfinished and presents another offer.

CTM360 found that some paths ask for a mobile number and a PIN or one-time code. That process can sign the victim up for a recurring mobile subscription while generating an affiliate payment for the scam operator. BleepingComputer reports that the possible consequences include exposed personal information, unexpected phone-bill charges and more spam.

Who is affected

Anyone who clicks gift card ads or giveaway links can encounter these pages, especially people drawn in by a familiar brand or celebrity endorsement. The campaign can quickly change its copied brand, featured celebrity and website address, so recognizing one fake domain will not stop every version.

People who entered a phone number, supplied a PIN or verification code, installed an offered app, or completed registration forms face the clearest risk. The source does not disclose a complete list of affected websites, apps or mobile carriers.

What to do now

1. Close the page without completing verification. Do not enter a phone number, PIN, one-time code or additional personal details to reveal a gift card code.

2. Check your mobile bill and subscription list. Sign in to your carrier’s app or website, open the billing or services section, and look for unfamiliar recurring charges or subscriptions. Contact the carrier if you find one you did not approve.

3. Remove apps installed through the offer. On iPhone, press and hold the app and choose Remove App. On Android, press and hold it and select Uninstall, or remove it through Settings > Apps.

4. Change reused passwords. If a registration form collected a password that you also use elsewhere, replace it on every affected account with a unique password. The campaign described by CTM360 is not primarily a password-stealing operation, but reused credentials still create avoidable risk.

5. Warn other household members. Explain that a real-looking progress bar, partly hidden reward code or “human verification” task does not prove a giveaway is legitimate. Our family protection weekend guide can help households establish shared rules for suspicious links and unexpected offers.