A fake free-iPhone survey doesn't need your password. It waits until the end and asks for a $5 to $10 shipping fee. That tiny payment is the card trap.
KnowBe4 Threat Labs described a campaign built around fake reward surveys. Emails and texts promise popular Apple devices, headphones, or another expensive gift for answering a short customer survey.
Next, the page makes the victim do a little work. KnowBe4 says the survey asks a string of normal-looking questions, shows fake comments from supposed winners, and only then sends the user to a payment page. By that point, the prize can feel earned. Yeah, that is the trick.
KnowBe4 Threat Labs Free Gift Fallacy How Attackers Harvest
Small fee, real warning
KnowBe4 says the payment page collects credit-card details and personal information, then sends the data to attacker-run infrastructure, while the small fee makes the fake checkout page feel normal enough to finish. The free prize was never the product. The card was.
Real prizes are free, the FTC says. If someone asks for taxes, shipping and handling, processing fees, customs duties, a bank account, or a card number to get a prize, don't pay or provide the details.
KnowBe4 Threat Labs Free Gift Fallacy How Attackers Harvest, FTC Fake Prize, Sweepstakes, Lottery Scams
Domains move fast
Campaign sites also change quickly. KnowBe4 says attackers use hundreds of new domains, with some sites lasting less than 48 hours. A fake page can be too new for filters and blocklists to know it is bad.
That doesn't make "check the link" advice useless, but it is too weak on its own. The better rule is sharper. A free reward that asks for card details is not free, and a survey that ends in a payment page should be closed immediately.
Anyone who sees one should report it at ReportFraud.ftc.gov. Reports may not undo the loss, but FTC says reports are used and shared with law-enforcement partners to help investigations.
