CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands
Fraudulent reward portals and fake gift card giveaways are surging globally, tricking users into deceptive verification loops and paid subscriptions. These scams lure victims with a simple pitch: click an ad featuring a celebrity endorsement, claim a free gift card from a well-known brand, and complete a quick “human verification” step to unlock the reward. No actual gift cards are provided; instead, these campaigns operate as large-scale affiliate monetization schemes designed to collect personal information, generate application installs, and enroll unsuspecting users in recurring mobile subscriptions. Based on activity observed by CTM360, analysts identified more than 1,000 incidents linked to this recurring campaign.
Threat actors exploit consumer familiarity with established brands, frequently impersonating major retailers and consumer platforms such as PlayStation, Sephora, SHEIN, Walmart, and Amazon. To increase credibility, the campaigns rely heavily on social media distribution through sponsored social media ads, viral posts promoting “giveaways,” and fabricated endorsements from high-profile celebrities and influencers (such as MrBeast or Alix Earle). The underlying infrastructure is highly modular, allowing threat actors to swap out the impersonated brand, celebrity lure, and domain name without rebuilding the core scam engine.
Once a user clicks a malicious ad, they are redirected to a fraudulent reward portal. These websites display cloned brand logos and colors, fake participant numbers and live countdown timers, and fabricated testimonials from “recent winners” to appear credible. After a victim selects a gift card value, the site runs a scripted, visual progress animation simulating the generation of the card on the back end. The portal then displays a partially masked code (e.g., XXXX-XXXX-7F3A-XXXX) to convince the user that the reward is real and ready to claim. Before the full code is revealed, the victim is presented with a deceptive “Security Check” or “Human Verification” gate.
The “human verification” step is a deceptive pivot into what CTM360 identifies as “Trap 10.” Rather than performing a legitimate security check, the verification process redirects victims to third-party activities designed to generate revenue for the operators. Victims are pushed into an endless loop of completing surveys, quizzes, and promotional offers; installing unwanted third-party applications or browser extensions; or subscribing to paid mobile services through carrier-billing mechanisms. In all flows tested by CTM360, no reward was ever delivered. This campaign operates on a volume-and-conversion model; lure pages redirect victims through affiliate tracking URLs. For the victim, consequences include personal information exposure, unexpected mobile billing charges, and an influx of spam. For organizations, this represents a severe abuse of brand reputation, as attackers are operating at scale, weaponizing brand trust as a mechanism to drive lucrative affiliate conversions.