What should I do if I entered a fake giveaway?
Stop communicating with the account, save evidence of what happened, change any password you reused, revoke suspicious app permissions, and contact your bank or the platform if you shared payment or account information. Speed matters more than tidiness: the value of a fake giveaway is the access or data it collected, and most of that value disappears the moment you cut it off.
Do not spend the first hour deciding whether you were careless. Fake promotions are written by people who test urgency and lookalike branding on thousands of targets. Your job now is containment, then reporting.
Cut contact immediately
Do not reply again, click any link they sent, or open an attachment. Do not "ask for my data back." A reply confirms your account is watched, and the follow-up link is usually where the second stage lives. Leave the message thread in place as evidence, but stop responding. If you handed over a verification code, assume the account is compromised and start recovery through the platform's own login pages, not through anything the other party sent you.
Record what happened
While it is fresh, save the promotion URL, the account handle, screenshots of the post and any messages, the exact form fields you filled in, the date and time, and everything you sent, such as an email address, phone number, or payment. Keep original emails rather than deleting them. A short written timeline beats a folder of unlabeled screenshots later.
Change reused passwords
If you typed your usual password into the entry form, change it everywhere that string was used, starting with email, then the platform account, then anything else sharing it. Turn on two-step verification for your email first, because that account unlocks the rest. Unique passwords per site are what turn a future leak into a single-account problem.
Revoke app and account access
Fake giveaways often hide behind a "connect your account to validate entry" prompt. Review connected apps, active sessions, and permissions on every account involved, and remove anything you do not recognize and actively use. Then sign out of other sessions. If a bot swarm posted as you, revoking access is what stops it; deleting individual posts does not.
If payment data went in
Call your bank or card issuer using the number on the back of your card, not a number from the message. Give them the merchant details you handed over, whether anything was charged, and ask what protections and monitoring apply to your account. Turn on transaction alerts and review statements closely for the next few cycles, because small test charges sometimes precede larger ones.
If you shared identity documents or your address
Treat this as a longer-tail problem. Expect impersonation attempts and targeted messages that quote your real details back at you, so be suspicious of anything that sounds convincing because it knows your name, order, or city. If you sent a passport or license, ask the issuing authority what replacement or fraud-alert options exist, and look into a credit freeze or fraud alert if those are available where you live. For significant money loss or identity misuse, talk to a qualified professional.
Report it in the right places
Report the account to the platform under its scam or impersonation category. Separately, notify the impersonated brand through contact details on the brand's own legitimate website; brand-protection teams act on these reports and are the only party able to take down lookalike domains quickly. You can also tell Contest Listing about a suspicious promotion through its reporting option, if one is available, so the listing stops sending other people there.
Common mistakes
- Replying to argue, or to ask for your data to be deleted.
- Clicking "unsubscribe" or a recovery link inside the scammer's own message.
- Changing one password while the same string stays live elsewhere.
- Deleting the evidence before writing down a timeline.
- Reviewing posts but never revoking connected app permissions.
- Waiting weeks to call the bank because the first charge looked tiny.
Key takeaways
- Stop responding and stop clicking; further contact is the point of the scam.
- Save URLs, handles, screenshots, and a dated timeline before cleaning anything up.
- Change reused passwords starting with email, and enable two-step verification.
- Revoke unfamiliar app access and sessions, which is how hijacked accounts keep posting.
- Call your bank via the number on your card, and report the scam to the platform and the impersonated brand.