You "won." Now a page says grab your reward by downloading a "Prize Claim Tool," a "Winner Verification app," or a PDF that turns out to be an .exe. That download is the scam. No sweepstakes on earth — not Publishers Clearing House, not a brand on Instagram, not a local radio station — makes you install software to receive a prize. The install is the prize the crook is after: a keylogger reading your passwords, an info-stealer scraping your browser, or adware that hijacks every page you open. 🦠
Why "download to claim" is always the tell
Legitimate prize fulfillment is boring on purpose. You confirm a mailing address, sign a one-page affidavit for anything over $600 (so the sponsor can issue a 1099), and the prize ships or the funds transfer. At no point does a real sponsor need code running on your machine — they have nothing to gain from it and a mountain of liability if it goes wrong. So when a "claim" step is a file instead of a form, the giveaway framing is just bait wrapped around a payload.
The files travel under trustworthy-looking names — Prize_Verification.exe, Reward_Claim_Setup.msi, a Claim_Details.pdf.exe that hides its real extension, or a browser extension "required to release your winnings." Modern info-stealers like RedLine, Raccoon, and Lumma are sold as cheap kits and grab saved logins, autofill data, session cookies, and crypto wallets in seconds — often before any fake "verifying..." bar finishes. Once cookies are stolen, criminals can log into your accounts without even needing your password, sidestepping two-factor entirely.
Where these downloads ambush you
The link rarely says "malware," it says urgency. A DM or email crows "You won — download the claim tool before it expires in 24 hours," pushing you to act before you think. Others live on cloned "winner portals" reached from a fake giveaway post, or ride inside cracked-software and free-gift-card bundles where the "prize" and the infection arrive together. QR codes on mailers and comment replies are a growing vector because you can't see where they point until it's too late.
Watch for a specific pattern: a browser pop-up insisting you install a "codec," "security plugin," or "Flash update" to view your prize confirmation. Flash has been dead since 2020; any site demanding it is lying. Same with alerts screaming your device is "infected, download our cleaner to claim safely" — that's scareware, and the cleaner is the infection. Real download safety is dull: you go to the vendor yourself, not through a prize link someone sent you.
What to do instead
Treat every unsolicited "claim" file as hostile and never run it. Verify the win the boring way — go directly to the sponsor's known website or verified account and confirm through the original post, not the link in your inbox. Legit winner contact asks for a shipping address or a signed affidavit, never an install. If a message can't be confirmed on the brand's real channel, it isn't real.
If you already clicked, disconnect from the internet, run a full scan with Microsoft Defender or Malwarebytes, then — from a different, clean device — change your email, banking, and social passwords and enable two-factor everywhere. Report it to the FTC at reportfraud.ftc.gov. 🛡️
Real prizes ship — they never install. If claiming means downloading, close the tab.