that free PlayStation card is a survey mill, and CTM360 counted more than a thousand of them

the ad has a celebrity, a logo you already trust, and a progress bar that swears your gift card is 80 percent generated. then it asks you to prove you are human. then it asks again. then your phone carrier bills you for a subscription you do not remember starting, and the gift card never arrives. CTM360 says it watched this movie more than a thousand times.

the pitch, which you have already seen

CTM360’s overview: the firm “has identified more than 1,000 incidents linked to a widespread gift-card scam campaign that exploits trusted brands, celebrity identities, and fraudulent social media advertisements to lure users with promises of free rewards.” the campaign “impersonates well-known brands such as PlayStation, Google Play, Sephora, SHEIN, and Walmart,” and sends people to “fake reward portals where they are asked to complete surveys, verification steps, or subscription offers.” instead of a gift card, “users risk exposing personal information, installing unwanted applications, or signing up for paid services.”

the sponsored BleepingComputer piece repeats the 1,000-plus figure and adds Amazon to the impersonated-brand list. because Amazon does not appear on CTM360’s report-page brand list, we are leaving it attached to the sponsored write-up rather than promoting it into the primary list. the same sponsored article names fabricated endorsements from high-profile celebrities and influencers, “such as MrBeast or Alix Earle,” and says distribution runs through sponsored social ads and viral “giveaway” posts. CTM360’s own page says “celebrity identities” and “fraudulent social media advertisements” without naming those people. if you work brand protection for either of them, the tell is the same: they did not secretly start giving away Sephora cards in a Facebook ad.

the fake generation trap

the sponsored write-up is more detailed about the page itself, and the mechanics it describes match the overview’s “surveys, verification steps, or subscription offers” without requiring any exploit code:

• cloned brand logos and colors.
• fake participant counts and live countdown timers.
• fabricated testimonials from “recent winners.”
• after the victim picks a gift card value, a scripted progress animation that pretends the card is being generated.
• a partially masked code, the sponsored article’s example being something in the shape of XXXX-XXXX-7F3A-XXXX, so the victim believes a real code is sitting behind the blur.
• a “Security Check” or “Human Verification” gate that appears before the full code is revealed.

none of that is a technical breakthrough. it is a carnival booth with better CSS. the point of the masked code is the same as the point of a prize-wheel that always lands on “almost”: keep the victim emotionally invested long enough to complete one more step.

the verification loop is the business model

CTM360’s overview is blunt about outcomes: personal information, unwanted apps, paid services. the sponsored article names the pivot “Trap 10” and says the “human verification” step redirects into third-party activities that generate revenue for the operators. the loop, as that write-up describes it:

• surveys, quizzes, and promotional offers.
• unwanted third-party applications or browser extensions.
• paid mobile subscriptions through localized carrier-billing, after the victim submits a mobile number and a PIN or OTP.

if the user finishes a task, they do not get the card. the site reports the step as “incomplete” and pushes another offer. the sponsored article’s most useful sentence: “In all flows tested by CTM360, no reward was ever delivered.” that is the whole con, said without poetry. there is no back-office team printing PlayStation codes. there is an affiliate desk.

technically, CTM360 says (in the sponsored piece) that lure pages redirect through affiliate tracking URLs, passing parameters like offer_id and aff_id, so a completed mobile subscription can be attributed to the operator’s affiliate account. that is a volume-and-conversion model, not a credential-stealing kit. your password for PlayStation.com is not the prize. your phone number, your OTP, your installed junk, and your carrier bill are the prize.

because the infrastructure is “highly modular,” the same sponsored write-up says operators can swap the impersonated brand, the celebrity lure, and the domain without rebuilding the engine. that is why takedowns of a single fake-Sephora hostname will feel like punching fog. the next ad is already wearing a Walmart shirt.

what it costs the victim, and what it costs the brand

for the person who clicked: personal information handed to whoever bought the lead, unexpected mobile charges, more spam, and possibly a browser extension you will not remember installing. for the company whose logo got cloned: a customer-service queue full of people who are about to be angry at PlayStation, Sephora, SHEIN, Walmart, or Google Play for a card those companies never offered. CTM360 calls this “a severe abuse of brand reputation.” the sloth calls it the oldest franchise in advertising fraud, now with better countdown timers.

this is also why “just tell people not to be greedy” is a lousy control. the ad is designed to look like a promotion the brand might actually run, served in the same feed as real promotions, sometimes next to a face the victim already associates with giveaways. the failure is upstream of the victim’s personality. it is in ad review, in carrier-billing opt-in quality, and in the fact that a masked gift-card code is still enough theater to keep someone in the loop.

the tells, for humans

• an ad or “giveaway” post offering a free high-value gift card from a major retailer or game store, especially one that leans on a celebrity who is not posting from their own account.
• a reward portal that is not on the brand’s real domain, even if the logo is perfect and the countdown is ticking.
• a card that is “generated” in front of you and then hidden behind a human-verification step, a survey, an app install, or a mobile PIN.
• a site that marks finished tasks as incomplete and immediately offers another one.
• any page that wants your phone number and an SMS code in order to “release” a gift card. that is how carrier billing gets a yes.

if you already typed a number and a code, check your mobile bill for new subscriptions, remove unfamiliar apps and extensions, change passwords from a device you trust if you typed them anywhere on that trail (the campaign as described is not a password stealer, but people over-share when a progress bar is 90 percent full), and report the ad. in the United States that is ReportFraud.ftc.gov and the platform’s own ad-report button. if money left a card or a carrier bill, say so in the report. if you are the brand, the useful artifacts are the ad creative, the landing hostname, the redirect chain, and those offer_id / aff_id parameters, not a strongly worded tweet.

the sloth take

nobody generated you a gift card. they generated you a lead, then rented you to the next offer, then told you the card was still loading. CTM360’s landing page is enough to brief a helpdesk: trusted logos, celebrity bait, fake portals, surveys and subscriptions, more than a thousand incidents, and no reason to believe the card is real. the sponsored recap adds the masked code, the endless verification loop, and the affiliate hand-off. none of that requires you to download a sample or visit the portal to “see if it is still up.” it is still up somewhere. it is wearing a different logo this morning.

if someone is running ads in your brand’s clothing, or your users keep calling about a giveaway you never launched, that is a takedown and monitoring problem, not a press-release problem. Book a slot with Dark Edge Consulting.

sources

• CTM360, “Gift Card Scams: Fake Rewards & Brand Impersonation” (report overview; more than 1,000 incidents, brand list, survey/subscription monetization)
• BleepingComputer, “CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands” (November 7, 2026). the page is labeled “Sponsored and written by CTM360.”
• FTC consumer reporting: ReportFraud.ftc.gov