Security analysts at CTM360 have uncovered an escalating wave of global fraud campaigns targeting consumers through false promises of free gift cards. These campaigns rely on impersonating major brands and celebrities to lure victims into misleading "verification loops" whose core purpose is to trap them into paid subscriptions and collect their personal data through profit-driven models based on affiliate marketing.
The company has detected over 1,000 incidents linked to these recurring campaigns, where attackers exploit consumer trust in global platforms such as Amazon, Walmart, PlayStation, Sephora, and SHEIN. These attacks spread via sponsored ads on social media and trending posts, utilizing fake endorsements from celebrities and influencers like MrBeast to boost credibility and impart an air of legitimacy to the bogus offers.
The Mechanism of the "Card Generation" Trap
The campaign follows a well-studied psychological lifecycle that begins with luring the user, then directing them to a fake rewards portal displaying the logos and colors of the impersonated brand, along with fake countdown timers and fabricated win testimonials to foster a sense of urgency. To create a semblance of realism, the websites display animations suggesting that the system is "generating" a gift card code in the background, while showing part of the code (such as XXXX-XXXX-7F3A-XXXX) to convince the victim that the reward is real and ready to be claimed.
The major trick lies in the "Human Verification" stage. Instead of performing a real security check, victims are redirected to a vicious cycle of tasks that generate profits for the fraudsters, including:
- Completing lengthy promotional surveys and quizzes.
- Installing unwanted applications or browser extensions.
- Subscribing to paid mobile services through local carrier-billing systems.
In all the cases tested by CTM360, no gift cards were ever delivered, as the websites simply declare "step incomplete" to push the victim toward another offer.
The Shift from Phishing to Affiliate Profit
Technically, these campaigns differ from traditional phishing operations that aim to steal credentials; they operate on a "Volume-and-conversion" model. Attackers use tracking links belonging to affiliate networks, allowing them to earn immediate commissions as soon as the victim enters their phone number or completes a subscription process, making the attack highly profitable even without directly stealing user accounts.
What Changes Practically?
This development represents a shift in digital fraud strategies, where the goal is no longer just stealing passwords, but exploiting "brand trust" as a tool to achieve quick and continuous profits via affiliate networks. For users, the damage goes beyond merely wasting time to include unexpected subscription costs and privacy violations. For businesses, these attacks put their reputation at stake, requiring enhanced digital risk protection strategies to monitor brand impersonation and limit its impact on consumer trust.