Olexweb
Safety alert8 November 2026

Fake Gift Card Scams Impersonate Major Brands: Safety Alert

Cybersecurity firm CTM360 has uncovered a large-scale campaign where scammers create fake gift card giveaways using well-known brands and celebrity endorsements. Victims are sent to polished reward portals that show masked gift card codes, then forced through endless "human verification" steps that actually enroll them in paid mobile subscriptions and harvest personal data. No gift cards are ever delivered.

ShareWhatsAppFacebookX
How to spot it
  • Ads on social media feature celebrity endorsements (like MrBeast) offering free gift cards from major brands.
  • Fake reward portals copy brand logos, show fake countdown timers, and display fabricated winner testimonials.
  • A partially masked gift card code appears to prove the reward is real before verification is required.
  • "Human verification" redirects users to surveys, unwanted app installs, and carrier-billed mobile subscriptions.
  • In every flow tested by CTM360, no gift card was ever delivered to the victim.
Why it matters

This matters to everyday people, students, creators, and small businesses in Nigeria and Africa who are active on social media and may encounter these deceptive ads. The scams waste time, expose personal information, and can cause unexpected mobile charges that hurt tight budgets.

Protect yourself
  1. 01Ignore social media ads promising free gift cards, especially those with celebrity endorsements.
  2. 02Verify any giveaway on the brand's official website or verified social media accounts.
  3. 03Never complete "human verification" steps that ask for surveys, app downloads, or your phone number.
  4. 04Check your mobile bill regularly for unauthorized subscription charges.
  5. 05Report the scam ad to the platform (Facebook, Instagram, TikTok) and notify your mobile carrier if you were charged.
The facts

In the source’s own words

  • Over 1,000 incidents linked to this recurring campaign.“more than 1,000 incidents linked to this recurring campaign.”, BleepingComputer
  • Scams impersonate major brands like PlayStation, Sephora, SHEIN, Walmart, and Amazon.“impersonating major retailers and consumer platforms such as PlayStation, Sephora, SHEIN, Walmart, and Amazon.”, BleepingComputer
  • Campaigns use fabricated celebrity endorsements like MrBeast or Alix Earle.“Fabricated endorsements from high-profile celebrities and influencers (such as MrBeast or Alix Earle)”, BleepingComputer
  • Fake portals show masked gift card codes to convince users the reward is real.“The portal then displays a partially masked code (e.g., XXXX-XXXX-7F3A-XXXX) to convince the user that the reward is real”, BleepingComputer
  • Human verification leads to surveys, app installs, and paid mobile subscriptions.“Completing surveys, quizzes, and promotional offers. Installing unwanted third-party applications or browser extensions. Subscribing to paid mobile services”, BleepingComputer
  • No reward was ever delivered in all flows tested by CTM360.“In all flows tested by CTM360, no reward was ever delivered.”, BleepingComputer
Questions
What are fake gift card scams?

Scams that impersonate trusted brands to lure users into fake giveaways that lead to paid subscriptions and data collection.

How do I recognize a fake gift card giveaway?

Look for celebrity-endorsed ads, cloned brand sites, masked codes, and 'human verification' steps that ask for surveys or phone numbers.

What should I do if I've been scammed?

Check mobile bills for unauthorized charges, report the scam to the platform and your mobile carrier, and avoid completing further verification steps.

Written by Olexweb in our own words, based on reporting by BleepingComputer (8 November 2026). Every fact is quoted from that source. Things change: check the source before you rely on details.

More safety alerts
Windows 11 Sysmon: How to Track App Activity and Network Logs

Windows 11 includes Sysmon to log app activity and network connections in the background.

Remus Malware: Claims of Persistent Gmail Access – Safety Alert

Remus claims it can keep reading your Gmail after you change the password, but the claim isn’t proven.

Google Auto-Links Phone Numbers to Accounts: How to Opt Out

Google is automatically connecting your phone number to every signed-in account without your prior consent.

AI Missing Pet Scams: How to Spot Fake Images and Threats

Criminals create AI images from lost pet posts to extort owners with fake sightings and ransom demands.

Fake OpenAI and SpaceX Events Steal Microsoft and Google Accounts

Phishing pages mimicking AI events trick users into giving away their Google and Microsoft account access.