CTM360 tracks fake gift card giveaways that pay out in subscriptions, not cards

CTM360 has published a report on fake gift card giveaways that borrow the branding of large retailers and consumer platforms, and it says analysts linked more than 1,000 incidents to the campaign. The write-up appeared on BleepingComputer on November 7 as sponsored content, written by CTM360. Treat the numbers as the vendor's own.

The pitch is familiar. An ad or viral post offers a free gift card from a brand such as PlayStation, Sephora, SHEIN, Walmart or Amazon, sometimes with a fabricated celebrity endorsement attached (MrBeast and Alix Earle are named). The landing page clones logos and colours, shows a countdown and invented "recent winners", then runs a progress animation and reveals a partly masked code.

The full code never arrives. Instead there's a "human verification" step that CTM360 calls "Trap 10": surveys, app or extension installs, and mobile subscriptions billed through the carrier. Complete a task and the site marks it incomplete and offers another. In every flow CTM360 tested, no reward was delivered.

The money comes from affiliate commissions. Lure pages pass tracking parameters such as offer_id and aff_id, tying a victim's sign-up to an operator's affiliate account. CTM360 says the infrastructure is modular, so the brand, celebrity and domain can be swapped without rebuilding the scam.

What's missing is scale in the other direction: the report doesn't say how many people were caught, what the losses were, or which countries the carrier billing hit hardest. The 1,000-plus figure counts incidents, not victims.

For defenders, the useful detail is the carrier-billing leg. Unexpected premium SMS charges on a personal or company phone are worth chasing, and staff who handle brand monitoring have a reason to look for cloned reward portals using their logos. The report is a vendor's account of its own telemetry, so we'd read the incident count as a floor rather than a total.