CTM360 has documented more than 1,000 incidents in a recurring campaign that uses fake reward portals, celebrity lures, and deceptive verification steps to draw people into paid subscriptions. The campaigns impersonate well-known brands and consumer platforms, while no actual gift cards are delivered.
How the fake reward portals work
The scam starts with an ad that shows a celebrity endorsement and promises a free gift card from a familiar brand. After a click, the victim reaches a fraudulent reward portal that is built to look convincing with cloned logos, brand colors, fake participant counts, live countdown timers, and fabricated testimonials from supposed recent winners. A user chooses a gift card value, and the site then plays a scripted progress animation that makes it look as if the reward is being generated.
The portal shows a partially masked code, such as XXXX-XXXX-7F3A-XXXX, before asking the user to pass a “Security Check” or “Human Verification” gate. CTM360 says this process is part of the scam rather than a real security step. The company maps the activity as a fraud lifecycle that moves victims through curiosity, trust, and urgency.
What happens after verification
The verification stage sends victims into a loop of surveys, quizzes, promotional offers, unwanted app installs, browser extensions, and paid mobile services. The campaign uses localized carrier billing mechanisms to enroll users in recurring subscriptions. When a user finishes one task, the site marks it as incomplete and sends the person to another offer instead of releasing the promised card.
CTM360 tested the flows and says no reward was ever delivered. The firm also found that the lure pages route victims through affiliate tracking URLs with parameters such as offer_id and aff_id, which connect the registration to the operator’s affiliate network account. When a victim submits a mobile number and completes PIN or OTP verification for a subscription, the threat actor earns a commission.
Brands, platforms, and the risk to victims
The campaign frequently impersonates PlayStation, Sephora, SHEIN, Walmart, and Amazon. CTM360 also says the operators use sponsored social media ads, viral giveaway posts, and fake endorsements from celebrities and influencers such as MrBeast and Alix Earle to spread the lure.
For victims, the result can include exposure of personal information, unexpected mobile charges, and more spam. For organizations, the activity is an abuse of brand reputation that shows how attackers can use trust at scale to drive affiliate conversions.
Licensed under CC BY-ND 4.0 International