Fake gift card portals are steering users into surveys, unwanted downloads and paid mobile subscriptions while never delivering the promised reward, CTM360 says. In a sponsored article published by BleepingComputer on November 7, 2026, the company reported more than 1,000 incidents linked to the recurring campaign, with consequences including personal information exposure and unexpected phone charges.
The activity impersonates brands including PlayStation, Sephora, SHEIN, Walmart and Amazon. CTM360 describes the scams as growing globally, spreading through sponsored social media ads, viral giveaway posts and fabricated endorsements from celebrities and influencers such as MrBeast and Alix Earle. The reported total counts incidents, rather than affected people.
For consumers, the lure is a free reward from a familiar name. For the organizations being impersonated, the campaign abuses their branding to make revenue-generating offers appear trustworthy.
A reward that stays out of reach
A malicious ad takes the user to a fraudulent reward portal decorated with copied brand logos and colors. Fake participant counts, countdown timers and testimonials from supposed recent winners help create the impression of an active promotion.
After the user selects a gift card value, a scripted progress animation pretends to generate the card. The page then displays a partially hidden code, such as XXXX-XXXX-7F3A-XXXX, suggesting that a reward is ready and only one step remains.
That step is labeled “Security Check” or “Human Verification.” CTM360 calls this stage “Trap 10”: instead of checking whether the visitor is human, the site sends them to third-party activities that earn money for the operators.
Those activities include surveys, quizzes and promotional offers; installations of unwanted applications or browser extensions; and paid mobile subscriptions charged through local carrier-billing systems, which put service fees on a phone bill. Completing an activity does not unlock the card. The portal marks the task as incomplete and directs the user to another offer. CTM360 said none of the flows it tested delivered a reward.
How the operators get paid
CTM360 describes an affiliate commission scheme driven by large numbers of visitors completing offers. Unlike conventional phishing aimed at stealing login credentials, these flows monetize registrations, downloads and subscriptions while also collecting personal information.
The researchers observed redirects through affiliate tracking URLs carrying parameters such as offer_id and aff_id. These identifiers connect a visitor’s registration to the operator’s affiliate account. When a user submits a mobile number and completes PIN or one-time password verification for a subscription, the operator receives a commission.
The underlying infrastructure is modular, allowing operators to replace the impersonated brand, celebrity lure or domain without rebuilding the core scam. That makes the same sequence reusable across different promotions.
The practical consequence sits at the supposed verification gate: entering a phone number and confirming a code can complete a paid subscription instead of releasing a gift card. CTM360 identifies unexpected mobile charges, exposed personal information and increased spam as the resulting risks.
