The Short Answer
If a text says you won a gift card, usually a $500 or $1,000 card from a big retailer, and tells you to tap a link to claim it, it is a scam. A store you did not enter a contest with does not text you a surprise gift-card win. ScamVerify™ tracks the prize and lottery scam category this belongs to: 19,168 complaints in our FTC and FCC data, with 3,389 in the last 90 days. Here is the tell hiding in the numbers: those recent complaints came from more than 2,800 different phone numbers. That is the signature of a text-blasting operation cycling through fresh numbers, not one company running a real giveaway. Do not tap the link.
How the Gift-Card Text Actually Works
This is a smishing scam, a phishing attack delivered by text, and it runs in a short, repeatable sequence.
- The blast. Your number, pulled from a leaked or scraped list, gets a cheerful text: your number was selected, you have won a gift card, tap here to claim, offer expires in 24 hours.
- The tap. The link leads to a page dressed up to look like the retailer or a "rewards" portal, complete with a logo lifted from the web and a fake countdown timer.
- The harvest. To "verify" you or "ship" the card, the page asks for your name, address, email, and then the real target: your card number, sometimes with a small "shipping" or "activation" fee to make it feel legitimate.
- The aftermath. There is no gift card. What they got was your personal and payment details, which they use or resell, and your confirmation that your number is live, which brings more scam texts.
Why It Comes From a Random Number You Do Not Know
People often assume a real reward would come from a recognizable short code or the store's official app, and that instinct is right. These texts arrive from ordinary ten-digit numbers, or numbers that rotate constantly, because the senders burn through them to stay ahead of blocking and spam filters. That is exactly why our data shows thousands of different numbers behind a few thousand complaints in a single quarter. A legitimate rewards program you actually joined communicates through its own app or your account, not a surprise text from a number you have never seen. An unknown sender plus a prize you did not enter is the whole answer.
What Tapping the Link Really Does
The link is never a shortcut to a prize. It is the attack. Here is what each part is doing.
| What you see | What is really happening |
|---|---|
| "You won a $1,000 gift card" | Bait to get a tap; there is no card |
| A link to "claim" it | Leads to a fake page that harvests your details or pushes malware |
| A retailer's logo and branding | Copied from the web to look official; it is not the real store |
| "Expires in 24 hours" | A countdown to make you tap before you think |
| A small "shipping" or "activation" fee | Captures your card number and a real charge, for nothing |
Got a suspicious text?
Show Ava the message. She names the scam, tells you your next move, and can shut it down for you.
What a Real Reward Looks Like
If you genuinely have a reward or gift card coming, it shows up where you would expect it: inside the retailer's app, in your account when you log in directly, or from a program you knowingly joined. A real reward does not depend on tapping an unknown link under a countdown, and it never asks for your card number to "release" a card to you. When in doubt, ignore the text entirely and go to the retailer's website or app yourself. If there is a real reward, it will be there. If there is not, you have lost nothing.
Why You Got the Text
You did not enter anything, so why you? Your number sits on lists built from data breaches, old sign-up forms, and brokers who buy and sell contact details in bulk, and those lists get blasted with millions of these texts at once. You were not singled out, and the sender does not know who you are or whether you shop anywhere in particular. That is also why the message is so generic, a round-number prize, a big-name store, and no detail actually tied to you. Worse, any sign that your number is active, a tap, a reply, even sending "STOP", marks you as a live target and moves you onto lists that get hit harder. The quiet response, no tap and no reply, is the one that keeps you off the next blast.
What to Do With the Text
- Do not tap the link. That is the entire goal of the message.
- Do not reply, not even "STOP." Any response confirms your number is active and brings more texts.
- Do not enter any details if you already opened the page. Close it.
- Report and delete it. Forward the text to 7726 (SPAM) to report it to your carrier, then delete it.
- Let Ava check it. Paste the text or the link, and Ava checks it against the same threat data we track and tells you whether it is safe.
For the full set of prize and lottery scripts, see our guide to prize and lottery scams. The same operations run the Publishers Clearing House winner call and the pay-a-fee-to-claim prize pitch, and dangle the foreign lottery.
I Already Tapped the Link or Entered My Info. Now What?
If you only tapped and did not enter anything, close the page and you are almost certainly fine, though stay alert for more texts. If you entered card details, call your card issuer using the number on the back of the card, tell them you entered it on a scam site, and ask them to watch for or stop charges and, if needed, issue a new card. If you entered a password you use elsewhere, change it from a different device and turn on two-factor authentication. If you were prompted to install anything, remove it and run a security scan. Then tell Ava exactly what happened, and she will map out the specific next steps for your situation.
