Guide Scams and phishing
Fake prize and giveaway scams: how to spot them and what to do if you've sent a code or card details
A message arrives on Messenger or WhatsApp: you've won a car, a phone or a voucher. Often it comes from a friend, so you believe it. To claim the prize you just need to send your phone number, then a code from a text message, a photo of your bank card or a small delivery fee. A real giveaway asks for none of these. Czech police have described people losing anything from a few hundred to several thousand euros this way. Here's how to spot a fake prize and what to do if you've already sent something.
Key points
- A real prize never needs a code from a text message, a photo of your bank card, your online banking login or a delivery fee. The moment a message asks for any of those, it's a scam.
- The 'you've won' message often comes from a friend's account – which a scammer may already control. Call your friend to check.
- Text message codes are for logging in or approving payments. Forward one and you may be handing over your social media, WhatsApp or bank account.
- Already sent a code, card details or a login? Call your bank and block the card now, change your account password and report it to the police.
What the scam looks like
The scammer promises a prize, then asks step by step for things that unlock your accounts or your money. Police and national CERTs describe two main versions:
- A message from a "friend". Someone you know writes on Messenger, WhatsApp or another app: they've found a giveaway you can enter, or you've already won. Their account is already in a scammer's hands. They want your phone number, then the code from the text you receive, and finally a photo of your card or your online banking login (Czech Police, 2025 and 2023).
- A fake giveaway on social media. A page posing as a well-known brand offers a phone, a TV or a fridge for sharing a post. The "winner" then gets a message asking for payment card details (SK-CERT, Slovakia's national CERT). Another version is a car prize that only needs a "delivery fee" (Czech Police, 2025).
Real cases
November 2025 – a "20,000 crown voucher". A woman in South Bohemia was told by a "friend" about a giveaway on a discount website. After she sent her phone number and the text message code, she was told she'd won a voucher worth 20,000 Czech crowns (about €800). To pay it out, the scammer asked for her online banking username and password. More than 10,000 crowns left her account; only blocking the account quickly stopped further payments.
July 2025 – a car for a 6,000 crown "delivery fee". A pensioner got a Messenger message saying she'd won a car and had to pay 6,000 crowns for delivery. She refused to pay but entered a code the scammer sent her, which probably gave him temporary control of her Facebook profile. She also sent a photo of her ID card. When she wouldn't hand over a security code, he threatened her. She stopped replying, blocked him and went to the police.
2023 – more than 180,000 crowns. A woman sent a "friend" her phone number and the text code, then photos of both sides of her bank card to receive a 22,000 crown prize. Believing she was accepting the prize, she approved payments – and lost more than 180,000 crowns (about €7,000) in total.
How to spot a fake prize
One of these is enough:
- They want a code from a text message. Those codes are for logging in or approving payments, not for receiving a prize.
- They want a photo of your card or its details. As SK-CERT puts it, nobody needs your card details except you.
- They want your online banking login. To send you money, all anyone needs is your account number.
- They want a fee – for delivery, tax or "activation". The FTC: if you have to pay to get your prize, it's a scam.
- You've won a giveaway you never entered, or one you entered just by sharing a post. Plus pressure: "Confirm within the hour."
Already sent something?
- Call your bank first if a card or banking login was involved. Use the number on your card or the bank's official website, block the card and change your login details. Go through recent payments and dispute any you didn't make. Speed matters: in the November 2025 case, blocking the account stopped further payments.
- Sent a text code? Recover the account. For Facebook or Messenger, change your password and log out unknown devices in the security settings – step by step in My account has been hacked; for WhatsApp see WhatsApp account hacked. Then turn on two-step verification.
- Warn your contacts. A hijacked account usually sends the same "prize" or a plea for money to everyone in your list (see Hi Mum, I've got a new number).
- Report it. Contact your local police. In the US, report it to the FTC at ReportFraud.ftc.gov; if your personal details were used, IdentityTheft.gov has recovery steps.
- Sent a photo of your ID? Mention it in your report. Scammers reuse ID copies for further fraud and for threats – what to do next: I sent a photo of my ID to a scammer.
- Typed details into a "claim your prize" page? Follow I entered my details on a phishing site.
How to avoid it next time
- Never send text message codes, card details or banking logins to anyone.
- A prize or giveaway message from a friend? Call them.
- Check a giveaway on the organiser's official website or page, not through a link in a message.
- You never pay for a prize – not even a delivery fee.
- Turn on two-step verification for your social media and messaging apps.
FAQ
A friend messaged to say I've won something and wants my phone number. Is it a scam?
Very likely. Czech police have described several cases where a scammer wrote from a friend's account, asked first for a phone number and then for the code that arrived by text. Call your friend on a number you already know and ask them directly. Don't send anything until you've checked.
Why would someone sending me a prize need a code from a text message?
Those codes are used to log in to accounts or approve payments. If you forward one, the scammer can use it to take over your social media or messaging account, or to approve a payment from your card. Police advise never forwarding these codes to anyone, friends included.
They only want a small delivery fee for the prize. Could that be genuine?
No. A real giveaway delivers the prize without charging you. The FTC puts it simply: if you have to pay to get your prize, it's a scam. Fees for taxes, shipping or processing don't belong in a real giveaway.
I sent a photo of both sides of my bank card. What now?
Call your bank immediately and block the card. A photo of both sides shows the card number, expiry date and security code, which is enough to pay online. Go through recent transactions with your bank and dispute any you didn't make, then report it to the police.
How can I tell a real giveaway from a fake one?
A real giveaway has rules published on the organiser's official website or page, the winner is contacted by the organiser itself, and it never asks for money or card details. Be suspicious of prizes for simply sharing a post, profiles that only look like a well-known brand, and pressure to act fast. If in doubt, contact the organiser through its official website.
Sources
- FTC – Fake Prize, Sweepstakes, and Lottery Scams (updated September 2025)
- FTC – Report fraud (ReportFraud.ftc.gov)
- SK-CERT – Facebook can also be used for phishing, we'll show you how to protect yourself (26 October 2020)
- Czech Police – Another scam on social networks (South Bohemian Region, 24 November 2025, in Czech)
- Czech Police – Don't get taken in (Strakonice district, 29 July 2025, in Czech)
- Czech Police – Instead of a prize, women lost their savings (Moravian-Silesian Region, 17 October 2023, in Czech)
Spotted a mistake? Let us know and we will correct it openly.
Related
Guide
"Hi Mum, I've got a new number": how to spot the scam and what to do
A message from a number you don't know: "Hi Mum, I dropped my phone, this is my new number." A few messages later comes a request for an urgent payment. It isn't your child – it's a scammer. Here is how to tell, how to check safely and what to do if you've already sent money.
Guide
Task scam: paid to like videos or rate apps? What to do
"Work from home, just like videos or rate products, earn hundreds a day." The first small payments really do arrive. Then you're asked to deposit your own money to unlock better tasks or withdraw your earnings. Here is how to spot this scam, what to do if you've already paid, and why moving money for a "job" can get you into trouble yourself.
Guide
Fake Meta “your Page will be deleted” messages: how to spot the scam and what to do if you entered your password
An email or Messenger message with the Meta logo tells you your Page has violated Community Standards or someone's copyright and will be permanently disabled within 24 hours. If it's a mistake, you can “appeal” through a link. The link leads to a copy of the Facebook login page that asks for your password and the code from your text messages. Anyone who fills it in can lose their profile, their business Page and their ad account. Meta itself lists messages threatening to ban or delete your account as a classic sign of a scam. Here's how to check the warning inside your account and what to do if you've already entered your password.