You've won a prize: the fake lucky draw by call or SMS that asks you to pay

You've won a prize: the fake lucky draw by call or SMS that asks you to pay

"Congratulations! Your number has been selected in our anniversary lucky draw. You've won an iPhone. Pay S$2.90 for delivery to claim it." Or a cheerful caller says you have won shopping vouchers from a supermarket, a telco or a bank. You did not enter any draw, but the prize is tempting and the fee is tiny. This is the fake prize scam. The small fee is not the goal: they want your card details and OTP, or a series of larger "taxes" and "handling charges". The rule: a real prize never asks you to pay to receive it.

How does the fake prize scam work?

1. The announcement. An SMS, WhatsApp, email, call or social media post says you have won. It uses the name of a well-known brand, a shopping mall, a telco, or even a government scheme.
2. The hook. A small fee for "delivery", "insurance", "processing" or "customs".
3. The data grab. A link leads to a page that asks for your card number, CVV and then the OTP your bank sends. With these, they make much larger charges or add your card to their own mobile wallet.
4. The escalation. By phone, a "prize officer" may ask for more fees, a "tax", or gift card codes, each time with a new excuse.

There are also versions on social media: fake brand pages running "giveaways", or comments saying "you've won, DM us".

Why does it look believable?

• Real brands do run promotions, so a lucky draw is plausible.
• The amount is tiny, so you do not think twice.
• The pages look professional, with logos and countdown timers.
• Your name or number is mentioned, because data from leaks is cheap.

What are the red flags?

• You never entered the draw.
• You must pay to receive the prize, however little.
• A link to an unfamiliar domain, rather than the brand's official website.
• Urgency: "claim within 24 hours".
• Requests for card details, OTPs, gift card codes or bank logins.
• The sender is a random mobile number. Organisations that send SMS to Singapore users with a sender name must register with the SMS Sender ID Registry; unregistered sender IDs may be labelled "Likely-SCAM". IMDA explains this on its anti-scam measures page.

What should I do if they've just called or texted me?

1. Do not tap the link and do not reply.
2. Hang up if it is a call. Do not give any details.
3. If you want to check, go to the brand's official website or app yourself, typing the address yourself. If there is a real promotion, it will be there.
4. Report the message through ScamShield and block the sender.
5. If unsure, call the ScamShield Helpline (1799).

What if I've already paid or given my card details?

1. Call your bank now on the number on your card or in its app. Ask them to block the card and review recent transactions. Even if you paid only a few dollars, the card details are compromised.
2. If you shared an OTP, tell the bank explicitly: it may have been used to approve a payment or register your card on another device.
3. If you bought gift cards for them, contact the gift card issuer straight away with the codes and receipts.
4. Keep evidence: the SMS, the link, the number and any receipts.
5. Make a police report through SPF e-services and follow ScamShield's I've been scammed checklist.

Where do I report it?

Report the message through ScamShield, make a police report if you lost money, and warn others by reporting the number in the spam numbers directory. You can also inform the brand being impersonated through its official customer service.

Frequently asked questions

The brand is real. Could the prize be real? Brands do run real draws, but you would have entered them, and they would not ask you to pay through a link in an SMS to collect.

It's only S$2. What's the harm? The harm is not the S$2: it is the card details and the OTP you enter to pay it.

They called me by name. How did they know? Personal details are often available from past data leaks. Knowing your name does not make the caller legitimate.

Is it worth reporting if I didn't pay? Yes. Every report helps ScamShield and others recognise the campaign faster.

In short

You did not enter, you must pay, there is a link and urgency: it is a scam. Do not tap, do not pay, check on the brand's official site, and if you already entered card details, call your bank now. And report the number in the NoCall spam numbers directory.