Fake Gift Card Scams Exploit Trusted Brands in Over 1,000 Global Incidents

What happened

CTM360’s latest fraud‑risk report documents over 1,000 incidents of fake‑gift‑card campaigns that impersonate well‑known retailers such as PlayStation, Sephora, SHEIN, Walmart and Amazon. Victims are lured by paid social‑media ads or viral posts promising a free gift‑card. After clicking the ad, users are redirected to a cloned reward portal that displays brand logos, fabricated “live” counters and a partially masked card code. Before the full code is revealed, the site forces a deceptive “human verification” or “security check” step that collects personal information and enrolls the victim in recurring mobile subscriptions. The underlying infrastructure is modular, allowing threat actors to swap brands, celebrity endorsements and domain names without rebuilding the core scam engine. CTM360 estimates the campaigns generate significant affiliate revenue while harvesting personal data at scale.

Why it matters for trust and compliance

• The operation underscores the importance of a security‑awareness program and continuous monitoring of brand impersonation, a control that maps to multiple frameworks such as NIST CSF 2.0.
• Provides evidence that phishing‑awareness training is required for audit readiness across frameworks.
• Supports continuous brand‑monitoring as defensible evidence for third‑party risk and control assurance.

Who is affected

Recommended actions

1. Implement regular phishing‑awareness training that includes brand‑impersonation scenarios.
2. Deploy brand‑monitoring tools to detect cloned logos, fake domains and counterfeit ad creatives on social media.
3. Document training participation, simulation results and monitoring alerts as audit‑ready evidence.