Phishing remains widespread. CISA notes that the FBI received 193,407 phishing complaints in 2024, making it the most reported cybercrime that year. Treat every unexpected reward as unverified, even when the message appears to come from a company you know.
How does a fake gift card offer work?
The prize is bait. The real goal may be your account credentials, card number, address or device access. A scammer may also ask you to buy another gift card to cover fees and send the card number and PIN. The FTC is clear: no honest business or government agency will require gift-card payment to release a prize.
What are the signs of a gift card phishing scam?
- You never entered the contest: A prize for an event you do not remember joining is not a lucky break.
- The message creates urgency: “Claim now,” countdown timers and threats of expiration discourage verification.
- The sender does not match the brand: Look for extra characters, free email accounts or a strange reply-to address.
- The link is misspelled or shortened: A familiar brand name inside a longer, unrelated address can hide the destination.
- The offer asks for sensitive information: A legitimate gift should not require your password, one-time code or full payment details.
- You must pay to receive the prize: Fees by gift card, wire transfer, cryptocurrency or payment app signal a scam.
What should you do when a suspicious gift card offer arrives?
- Do not click or reply. Avoid buttons, links, attachments, QR codes and “unsubscribe” options inside the message.
- Inspect without interacting. Check the sender and preview the destination on a computer by hovering over the link. Misspellings help, but polished wording does not prove safety.
- Verify independently. Open the company’s official app or type its known address yourself. Check your rewards or promotions there, or contact support using information you found independently.
- Delete and report the message. Mark it as phishing or junk so your provider can improve filtering. If it reached a work account, follow your organization’s reporting process.
- Warn others carefully. Share a screenshot or description, not the active link. A quick warning may stop the same lure from reaching family or coworkers.
CISA describes phishing as messages or malicious websites that impersonate trusted entities to steal information or deliver malware. Its phishing guidance recommends skepticism toward urgent, too-good-to-be-true offers and suspicious hyperlinks.
Can clicking a gift card link install malware?
It can, although many phishing pages focus on stealing what you type. Close the page if you clicked but did not enter anything. Do not approve downloads, browser notifications, profiles or security prompts. Update the device and browser, then run a scan with trusted security software already installed on the device.
If you entered a password, change it immediately through the real service and anywhere you reused it. Enable multifactor authentication, review active sessions and protect your primary email first because it can reset other accounts. If you entered payment details, contact the issuer through the number on the card.
What if you bought or shared a gift card?
Contact the gift card company immediately and ask whether it can freeze the funds or issue a refund. Keep the physical card, purchase receipt, packaging and every message. Do not trust anyone who later promises to recover the money for an upfront fee; recovery scams often target people twice.
Turn “pause and verify” into a habit
Ignoring an unsolicited gift card offer protects more than the promised reward. It keeps your credentials out of copycat login pages, prevents small “fees” from exposing a card and blocks attackers from using a compromised account against people who trust you. The safest response is simple: leave the message, reach the company independently and delete the lure.
