Fake gift card giveaways impersonating well-known brands and public figures are operating as data-harvesting funnels that convert borrowed trust into subscription revenue — with no reward ever delivered, according to research from CTM360 summarised by BleepingComputer.
The lure is cheap to produce and trivially adaptable: swap a logo, swap a celebrity, keep the same funnel. That economics is what makes gift cards a preferred wrapper for this class of campaign — the operators are running infrastructure, not promotions.
The campaigns do not end at tricking a victim into clicking a link. As the security firm's analysis describes it, the promised gift card is only bait: the funnel itself is the product. Consumers are walked through a sequence of verification steps that collects personal information, then nudged into signing up for paid subscriptions or completing affiliate actions that generate revenue for the operators. The advertised reward never arrives.
How the funnel works
CTM360's breakdown points to four recurring mechanics that appear across these campaigns:
-
Borrowed identity. Campaigns lean on the logos, naming conventions and visual language of established brands, or on the names and likenesses of celebrities, to import instant credibility. The sender is trading on trust they did not earn.
-
Manufactured urgency. Limited-time claims, countdown timers and "only a few left" framing push recipients toward acting before verifying.
-
Phased verification. Rather than asking for everything at once, the funnel stages its requests — email, phone number, address, then progressively more sensitive details — so each step feels like ordinary due diligence.
-
Affiliate monetisation. Once a recipient is engaged, the campaign pivots to the actual revenue event: subscription sign-ups, offer completions and affiliate attribution that pay out regardless of whether any gift card exists.
Why "just be sceptical" is not enough
The uncomfortable part of CTM360's findings is that these funnels deliberately imitate the rituals of caution. A verification code, a branded confirmation screen, a step-by-step eligibility check — the experience of being scammed now closely resembles the experience of being careful. Conventional advice to "think twice before you click" underestimates the craft involved.
A more useful mental model: the sender is the customer, and the recipient is the inventory. Every interaction is designed to extract value from the person on the receiving end, not to deliver value to them.
Habits worth briefing
For professionals sharing these habits with their teams or family members, the countermeasures are mundane and repeatable rather than technical:
- Check the domain, not the branding. Logos are trivial to copy; the sending domain and the destination URL are the tell.
- Treat celebrity endorsements of free giveaways as a red flag in themselves. Legitimate promotions do not arrive unsolicited through impersonal links.
- Refuse any "verification" that asks for payment details, referral codes or friend sign-ups. Those are monetisation steps dressed as security steps.
- Watch for the subscription pivot. If a free reward suddenly requires a recurring plan or trial enrolment, the funnel has reached its purpose.
- Audit your bank and card statements. Unrecognised micro-charges are often the first visible residue of a completed funnel.
The wider pattern
The playbook is not unique to gift cards. Fake crypto giveaways and impersonated delivery-notification scams run on the same trust-renting model: borrow a recognisable identity, manufacture urgency, stage the data capture, monetise through affiliates or transactions. What differs is the wrapper.
The takeaway is that alerts and warnings age quickly, but counter habits compound. Given how far these funnels now imitate legitimate verification, the most durable defence is teaching people what the funnel is actually doing — not just that it exists.
Source: BleepingComputer, summarising research from CTM360.
據 CTM360 研究並由 BleepingComputer 綜合報道，冒充知名公眾人物及品牌的虛假禮品卡贈送活動，實際上是充當數據收集的漏斗，將借來的信任轉化為訂閱收入 — 而承諾的獎賞從來不會送出。
此類引誘手法製作成本低廉，且極易改造：更換標誌、更換名人，漏斗則維持不變。正是這種經濟特性，令禮品卡成為這類活動的首選包裝 — 營運者建構的是基建，而非推廣。
活動並不僅止於誘騙受害人點擊連結。正如該保安公司的分析所述，承諾的禮品卡只是魚餌：漏斗本身才是產品。消費者會被引導完成一系列蒐集個人資料的驗證步驟，繼而被推動登記付費訂閱或完成為營運者帶來收入的 affiliate 推廣行動。廣告宣稱的獎賞永遠不會出現。
漏斗如何運作
CTM360 的拆解指出四種在此類活動中反覆出現的機制：
-
借用身份。 活動藉助知名品牌的標誌、命名慣例及視覺語言，或利用名人的姓名及肖像，以即時建立可信度。發送者利用的是其從未贏得的信任。
-
製造人為緊迫感。 限時領取、倒數計時器及「僅餘少量」的措辭，推動收件人在未經核實前先行動。
-
分階段驗證。 漏斗不會一次性索取全部資料，而是分階段提出請求 — 先取電郵地址、電話號碼、住址，繼而逐步索取更敏感的資料 — 令每個步驟感覺只是一般合理的查證程序。
-
Affiliate 變現。 一旦收件人參與其中，活動便轉向真正的收入來源：登記訂閱、完成推廣優惠，以及 affiliate 歸因 — 無論禮品卡是否真的存在，均會派發報酬。
為何「保持懷疑」並不足夠
CTM360 發現中令人不安的部分是，這些漏斗刻意模仿謹慎行事的流程。一個驗證碼、一個帶品牌標誌的確認畫面、逐步進行的資格審查 — 被騙的體驗如今與小心行事的體驗極為相似。「點擊之前三思」之類的傳統建議，低估了當中涉及的手法。
一個更有用的思維模型：發送者才是顧客，收件者只是庫存。每一次互動的設計目的，都是從接收方身上榨取價值，而非向其提供價值。
值得向團隊或家人傳達的習慣
對於需要將這些習慣與團隊或家庭成員分享的專業人士而言，對策並不需要技術知識，而是平凡且可重複執行：
- 檢視 domain，而非品牌包裝。 標誌極易抄襲；發送 domain 及目標 URL 才是破綻所在。
- 將名人代言免費贈送本身視為警號。 合法推廣不會透過非個人化的連結不請自來。
- 拒絕任何索取付款資料、推薦碼或要求朋友登記的「驗證」。 這些其實是變現步驟，只不過包裝成保安步驟。
- 留意轉向訂閱的轉折。 如果免費獎賞突然要求登記定期計劃或試用計劃，漏斗已達到其真正目的。
- 檢查銀行及信用卡月結單。 不認識的小額扣款，往往是漏斗完成後最先可見的殘留痕跡。
更廣泛的模式
這套手法並非禮品卡專有。虛假加密貨幣贈送及冒充快遞通知的騙局，運作的都是同一種「租借信任」模式：借用一個可辨識的身份，製造緊迫感，分階段蒐集數據，再透過 affiliate 或交易變現。不同的只是外層包裝。
重點在於，警報及警告很快便會過時，但對策習慣會不斷累積。鑑於這些漏斗模仿合法驗證程序的程度已相當深入，最持久的防禦方法是教導人們漏斗實際上正在做什麼 — 而不單是知道它的存在。
資料來源：BleepingComputer，綜合 CTM360 研究。