"You've won a prize": the fake raffle by call or SMS that asks you to pay

"Congratulations! You've been selected to receive an iPhone", "You've won a €500 gift card", "Your number has been drawn in our annual prize draw". The message arrives by SMS or in a phone call, and it always comes with a small condition: pay a shipping fee, a charge or a tax, or give your card details "to verify your identity". It's one of the oldest scams around, and it still works because the amount they ask for looks tiny next to what they promise. The rule that settles it all: a real prize never costs you money up front.

How does the fake prize scam work?

It comes in several versions, but they all share the same skeleton: unexpected good news, a small condition and a rush.

• SMS with a link. You're told you've won a phone, a voucher or a gift from a well-known brand (a supermarket chain, your mobile carrier, an online shop). The link leads to a website that copies the brand's design, often with a survey or a wheel of fortune that you "always" win. At the end they ask for €1 or €2 in shipping and your full card details. That small payment is the excuse: what they want is your card, and sometimes they sign you up for a monthly subscription hidden in the small print.
• A call about a supposed prize. A friendly voice (or a recording) congratulates you on a draw run by your phone company, an "international lottery" or a contest you never entered. To release the prize they ask you to pay fees, taxes, notary or customs charges up front, by bank transfer, by instant mobile payment (Bizum in Spain) or with gift cards.
• Card details and a code. In the most dangerous variant they don't ask for a payment. Instead they ask you to read out your card number "so we can pay the prize in" and then the code you receive by SMS. That code isn't for receiving money: it's for authorising a payment or linking your card to someone else's phone.

If you pay the first fee, a second one almost always follows: "the prize is being held at customs", "the insurance is still missing". The chain of payments only ends when you stop paying.

Why does it look believable?

Because it's designed to. They use the logos and names of real companies, the website imitates their look, the SMS can land in the same thread as genuine messages from that brand, and the call can display a number that looks local. On top of that, the amount is small on purpose: nobody thinks twice about €1.95. And the rush ("only 3 prizes left", "offer expires today") stops you from pausing to check.

What are the red flags?

1. You've won something you never entered. Nobody wins a draw they didn't sign up for.
2. You have to pay to collect. Shipping, fees, taxes or "handling": with a legitimate prize, none of these are paid up front to the person telling you about it. In Spain, the tax on a real prize is withheld when it's paid out or declared afterwards to the tax agency, and the same principle applies in most countries.
3. They ask for your card details or an SMS code. Nobody needs your security code, your expiry date or the code your bank sends you in order to give you money.
4. There's urgency or secrecy. "Reply within 24 hours", "don't tell anyone or you'll lose the prize".
5. The payment method is odd. Gift cards, cryptocurrency, an instant payment to a private individual or a transfer to a foreign account.
6. The link isn't the official domain. Long addresses with hyphens, numbers or strange endings instead of the brand's usual website.

A single one of these signs is enough to hang up or close the message.

What should I do if they've just called or texted me?

1. Don't tap the link or reply to the SMS. Not even to say you're not interested: replying confirms your number is active.
2. If it's a call, hang up. You don't need to be polite or explain yourself. Don't give your full name, ID number, address or bank details.
3. Check for yourself if you're still unsure. Look up the official phone number or website of the company that supposedly picked you (not the one in the message) and ask whether that draw exists.
4. Take a screenshot of the SMS or write down the number, the time and what they told you. It'll help if you need to report it.
5. Block the number and report it in the spam numbers directory so others can recognise it.

What if I've already paid or given my card details?

Act fast and don't feel ashamed: these websites are built to fool anyone.

1. Call your bank now, on the number on the back of your card or in its official app. Ask them to block the card and issue a new one.
2. Tell them if you gave any SMS code: there may already be an authorised payment, or your card may be linked to someone else's phone.
3. Check your transactions over the coming weeks and turn on charge notifications. Fraudulent charges or subscriptions sometimes take a while to show up.
4. If you paid by instant payment or bank transfer, tell your bank as soon as possible; in some cases there are ways to recover the money, which we explain in how to recover money lost to a phone scam.
5. If you gave your ID number or other personal details, watch for identity theft: loan applications or phone lines opened in your name.
6. Don't pay any more fees, even if they promise it's the last one needed to release the prize.

Where do I report it?

• The police: in Spain, the Policía Nacional (091) or the Guardia Civil (062); elsewhere, your national or local police. File a report with the screenshots, the number and any payment receipts. This is essential if you lost money.
• A cybersecurity helpline: in Spain, INCIBE's 017 is a free, confidential cybersecurity helpline that will guide you on what to do and how to protect your accounts, and the OSI (Spain's Internet User Security Office) website publishes alerts about active campaigns. Elsewhere, contact your national cybersecurity agency or consumer fraud service.
• 112: only if there's an emergency or an immediate threat.
• Your bank: always through its official channels.

Frequently asked questions

What if I really did enter a draw from that brand? Check the brand's official website or app, going there directly yourself, to see whether winners have been announced. A legitimate draw may ask for your details to send you the prize, but it won't charge you fees or ask for your card's security code.

It was only €1.95, should I worry? Yes: the problem isn't the €1.95, it's that they now have your full card details. Block the card just in case.

Someone from "the lottery" called to say I've won. Lottery prizes are collected by presenting your ticket at an authorised retailer or bank. In Spain that's the state lottery, Loterías y Apuestas del Estado, and the same goes for national lotteries elsewhere. Nobody calls you to announce it or to charge you fees.

How do they know my name? From data breaches or purchased databases. Knowing your name doesn't prove the prize is real.

In short

If you have to pay something or give your card to collect a prize, it isn't a prize: it's a scam. Hang up, don't tap the link, check through the official channel and, if you've already shared your details, call your bank and report it. NoCall warns you when a number has already been reported by other users; and if you've received one of these messages, report it in the spam numbers directory so the next person sees it before they take the bait.