CTM360 Exposes Global Fake Gift Card Scams Targeting Trusted Brands

“Based on activity observed by CTM360, analysts identified more than 1,000 incidents linked to this recurring campaign.”

1,000+ incidents and the exploitation of trusted brands

CTM360’s analysis finds a global surge in fraudulent reward portals and fake gift card giveaways that have been tied to more than 1,000 distinct incidents. The campaigns impersonate well-known consumer brands — including PlayStation, Sephora, SHEIN, Walmart, and Amazon — and deliberately exploit consumers’ familiarity with those brands to increase conversion rates. To boost credibility, threat actors also attach fabricated endorsements from high-profile celebrities and influencers, the report notes, citing names such as MrBeast and Alix Earle.

The Fake Generation Trap: how victims are lured and convinced

CTM360 maps the scam to a structured fraud lifecycle it calls the “Fake Generation Trap.” The progression begins when users click an ad — often distributed through sponsored social media ads or viral giveaway posts — and are redirected to a polished, fraudulent reward portal. Those sites typically present cloned brand logos and colors, fake participant numbers, live countdown timers, and manufactured testimonials from “recent winners.”

After a victim selects a gift-card value, the site runs a scripted visual animation that simulates back-end generation and then displays a partially masked code (for example, "XXXX-XXXX-7F3A-XXXX") to convince the user the reward exists. Before the full code is revealed, the user encounters a deceptive gate labeled as a “Security Check” or “Human Verification.”

The Endless Verification Loop and monetization model

CTM360 identifies the verification step as a deliberate pivot into what it labels “Trap 10.” Rather than verifying user authenticity, the gate funnels victims into a repetitive loop of monetizable tasks: completing surveys, taking quizzes, installing third-party applications or browser extensions, and subscribing to paid mobile services through localized carrier-billing mechanisms. In every test flow recorded by CTM360, no gift card was ever delivered; the site marks completed tasks as “incomplete” and moves the user to another offer.

The campaign operates not by stealing credentials but by volume and conversion. Its economic goal is to drive affiliate conversions and subscription activations that pay the operator commissions.

Technical observations: affiliate hand-offs and tracking tokens

CTM360 details how lure pages redirect victims through affiliate tracking URLs that pass parameters such as offer_id and aff_id. These tracking tokens tie a victim’s interactions — including mobile number submissions and PIN/OTP verifications used for subscription sign-ups — to the threat actor’s affiliate network account. When a mobile subscription is activated via a localized carrier-billing flow, the operator receives a commission.

This modular infrastructure allows rapid swapping of impersonated brands, celebrity names, and domain names without rebuilding the underlying scam engine, increasing the campaign’s resilience and scalability.

What this means for users, brands, and security teams

• End users: The immediate risks are personal information exposure, unexpected mobile billing charges, and increased spam. The scams are designed to look legitimate — complete with masked codes and animated progress indicators — making them effective at inducing trust and urgency.
• Named brands (PlayStation, Sephora, SHEIN, Walmart, Amazon): These companies face reputational abuse as attackers weaponize familiar branding to lure victims. The campaigns demonstrate how quickly brand trust can be co-opted at scale.
• Security teams and digital-risk professionals: The affiliate-driven conversion model and modular infrastructure mean detection and takedown require monitoring not just domains and landing pages but the affiliate flows and carrier-billing endpoints that monetize traffic. CTM360 positions this activity as part of a broader external-digital-risk surface that needs continuous observation and rapid mitigation.

CTM360’s findings present a blunt fact: well-designed visuals and a convincing partial code are sufficient to push many users into a chain of affiliate conversions that never result in a promised reward. The decisive detail — repeated across all tested flows — is that no gift cards were delivered, while operators harvested commissions and personal data. The practical question left by the report is concrete: which actors in the chain — platforms hosting the ads, affiliate networks passing offer_id/aff_id tokens, payment carriers enabling localized billing, or social channels distributing endorsements — will act to interrupt the conversion pipeline that currently rewards the scammers?

Read the original coverage: https://www.bleepingcomputer.com/news/security/ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands/