What should I do if I receive a suspicious winner notification?
Do not click links or pay fees. Verify the promotion and the sender through the organizer's official website or contact details you find independently, and read the notification terms in the official rules before you send anything, including your address. A genuine prize notification can usually be confirmed in two minutes, in public, by someone else, without you providing secrets.
Suspicion is the correct default. Winning is rare, most notifications arrive to people who never entered, and unsolicited messages are worth money to whoever sent them.
Do not click anything in the message
Skip the "claim" button, attachments, QR codes, and any phone number printed in the message. Links in these messages are chosen by the sender, and they often land on a page that imitates a brand login. If the promotion is real, you can reach it from the organizer's own site in seconds, and that route costs nothing.
Check whether you actually entered
Search your email, entry confirmations, and your own posts for the promotion. If you have no record and no memory of it, the message is almost certainly not for you. Organizers do notify people late and reach alternate winners, but nobody legitimately tells total strangers about a contest they never joined. "You were selected from thousands of entrants" with no contest name, date, or reference is a template, not a notification.
Find the organizer on your own terms
Open the brand's real website by typing an address you already know, then look for the promotion page, a winners page, or a press section. Compare the contest name, prize, entry period, and any published winner names against the message. No trace of the promotion, or different published terms, means stop.
If you entered through a promotion found on Contest Listing, open the organizer's page and compare the message with the rules it points to, rather than replying to the message.
Read what the official rules promise
Search the rules for notification, winner, selection, response, verification, and delivery. You want to know how winners are told, how long they have to respond, what they must provide, and whether winners are announced publicly. If the message contradicts the rules, the message loses; rules outrank any email, DM, or pop-up.
Judge the sender and the pressure
Check the actual sending address rather than the display name, and read the domain character by character for lookalikes. Then weigh the pressure: a countdown of a few hours, a claim that the prize will be "reassigned" imminently, or a request to reply to a personal email are pressure tactics. Real organizers publish deadlines in advance. A prize far larger than anything the sponsor normally gives away is another tell.
Never pay to receive a prize
Legitimate promotions do not require payment to collect a prize. Never pay a "processing," "customs," "courier," or "tax" fee by gift card, wire transfer, or cryptocurrency, and never buy gift cards and read out the codes. Where a real promotion does charge shipping, the official rules say so before you enter. Ask the organizer through independently found contact details; if the only answer comes through the original thread, treat it as a scam.
Never share credentials or access
You should never need a password, a two-factor code, a recovery code, or a "connect account" permission to claim a prize. Do not send identity documents into a reply thread, and do not let someone else manage your account. Verification, where required, happens through the organizer's own process rather than screenshots in a direct message.
If you already responded
Move fast. Change any password you typed into their form, starting with email, and enable two-step verification. If you sent a code or approved a permission prompt, revoke connected app access and sign out of other sessions. If you paid, call your card issuer using the number on the back of the card. Keep the messages and sender address, report the account to the platform, and report the impersonated brand through its own site.
Common mistakes
- Clicking the claim link first and thinking about it afterwards.
- Replying "is this real?" to the sender, which only confirms you read it.
- Trusting a display name or logo instead of the sending domain.
- Paying a small fee because the prize seemed worth it.
- Accepting urgency as evidence, when a manufactured deadline is the whole mechanism.
Key takeaways
- Verify outward from the organizer's own website; never follow the message's links.
- If you cannot find your own entry, assume the notification is not for you.
- Official rules define how winners are contacted and what they must provide.
- No legitimate prize requires money, gift cards, crypto, a password, or an authentication code.
- If you engaged already, cut access, change passwords, call your bank, and keep the evidence.