🎯  Host a contest 📢  Promote a contest 📝  Submit a contest

Should I click a link in a direct message saying I won?

No. Verify the message first, through a channel you found yourself. A direct message proves only that someone could send you a message; anyone can write "congratulations, you won" and attach a link, and the sending account may be a copy of a real one. Genuine promotions also announce winners on the sponsor's own channel, which gives you a second place to look that the sender does not control.

Waiting costs you almost nothing. Winners are normally given a response window measured in days, and a legitimate sponsor does not cancel a prize because the winner asked a question first. Clicking can cost you an account, a phone number, card details, or money sent to a stranger.

Why the message itself is not evidence

Scam messages borrow credibility from names, logos, and verified-looking profile pictures. Some come from a hijacked account belonging to a real person or brand, so the sender name checks out while the link does not. Others come from an account created days earlier with a near-identical handle. Nothing in the message body tells you which case you are in, so check the link destination and the sender outside the message.

Check your own records first

Search your email, entry confirmations, contest tracker, and the original post. Did you actually enter? Do you remember the prize? An entry usually leaves a trace: a confirmation email, a comment you left, a form submission, a receipt for a purchase-based entry. With no trace of entering, treat the message as unsolicited marketing at best and a scam at worst.

Type the brand's address into your browser yourself, or use a bookmark you already have, and look for the promotion on the sponsor's own site. Check the official profiles for an announcement naming the contest, the entry period, and how winners will be contacted. If you found the promotion through Contest Listing, open the listing, then confirm the details on the sponsor's page. If you want to ask something, use the contact route published on the sponsor's site rather than replying to the message.

What clicking can expose you to

A shortened or lookalike domain can land you on a page that imitates a login screen and captures your password. Some links push an app authorization request that quietly grants a third party access to your account, its messages, and your contacts. Others drive a form collecting your name, phone number, address, and birth date for resale, or deliver unwanted software to your device. Simply opening a page can leak information.

Requests that should end the conversation

Stop engaging if the sender asks for your password, a two-factor or one-time code, an approval on a login prompt, or permission to connect an app. Stop if you are told to pay a shipping fee, tax, customs charge, or processing fee, or to send a gift card, wire, or crypto transfer to release a prize. Stop if a bank or card number is requested in order to "send your winnings." A real sponsor verifies identity through documented processes and never needs the keys to your accounts.

What a genuine winner message looks like

Legitimate notifications reference the specific promotion you entered, name the sponsor running it, and point to the announcement or rules that described the notification method in advance. They arrive through the channel the rules promised, they do not demand immediate payment, and they survive being ignored for a day while you check the sponsor's site. Vagueness is the giveaway: "you have been selected" with no contest name, dates, or rules.

If you already clicked or replied

Change the password of the targeted account, sign out of all other sessions, and revoke connected apps or authorizations you do not recognize. Enable two-factor authentication using an app or hardware key rather than text messages where you can. Check recovery email and phone settings for silent changes. Watch statements and credit alerts if you entered card or identity details. Report the impersonating account to the platform, notify the real brand through its published contact channel, and keep screenshots before the message disappears.

Common mistakes

  • Replying "stop" or "no thanks," which confirms your account is monitored.
  • Trusting a verified-looking badge or follower count on the sending profile.
  • Sending a small fee to test whether a prize is real.
  • Sharing a one-time code because the sender called it verification.
  • Deleting the message before capturing evidence of it.

Key takeaways

  • Do not click links in unsolicited winning messages; open the sponsor's site yourself.
  • Confirm you actually entered, then confirm the win on the organizer's own channel.
  • Never send a password, code, app permission, or money to receive a prize.
  • If you clicked, change passwords, revoke sessions and app access, and monitor accounts.
  • Keep the message and screenshots so you can report it and support a claim later.