You just "won" a $500 gift card, and the only thing standing between you and the prize is a quick step: enter your credit or debit card number so the sponsor can "verify your identity." Stop right there. That single request is the whole scam, dressed up as paperwork. A card number verifies nothing about who you are — it verifies that an account exists and can be charged. Real giveaways confirm winners a completely different way, and once you know what that way looks like, the fake version falls apart on sight.
Real verification is a signed affidavit, not a card number
When a US sweepstakes has a retail value above $600, the sponsor is legally motivated to document the winner properly, because prizes are taxable income they must report to the IRS on a Form 1099-MISC. To do that, the winner signs an Affidavit of Eligibility and, usually, a Liability/Publicity Release, and provides a W-9 with their name, address, and Social Security number for tax reporting. Many sponsors require these to be notarized and returned within a stated window — often 7 to 14 days.
Notice what is not on that list: your card number, your CVV, your PIN, or an "activation fee." Verification exists so the sponsor knows you're a real, eligible person they can legally hand a prize and a tax form to — it flows from you to them on paper, and it never touches your ability to pay. A giveaway is something you receive. The moment a "prize" wants your payment card, the arrow has reversed, and you're the one being set up to lose money. 🚩
The CVV is the tell — legitimate verification never asks for it
The three or four digits on your card are the Card Verification Value, and they exist for exactly one purpose: proving to a merchant that a real cardholder is authorizing a charge. There is no scenario in which confirming a giveaway win requires proving you can be charged, so a request for the CVV — or for a "small refundable deposit," a "shipping and insurance fee," or a "release of funds" charge — is a confession that money is about to leave your account.
This framing works because it borrows the language of things you have verified with a card, like a hotel hold or a free-trial signup. But those are transactions where you agreed to potential charges. A prize is not a transaction. If someone insists the fee is refundable or that the card is "only to confirm you're a real person," treat it as fiction: legitimate prizes ship without you paying a cent, and taxes owed are handled by you directly with the IRS, never prepaid to the sponsor.
What to actually do when the card request appears
Do not enter anything. Instead, verify the sponsor the way they should be verifying you. Find the brand's official website or verified social account independently — type the address yourself rather than clicking the message's links — and confirm a real promotion exists, check the posted Official Rules, and look for the sponsor's legal name and mailing address. Real rules always name a specific entity you could send a notarized affidavit back to.
If the card request came by text, email, or DM, report it: forward suspicious texts to 7726 (SPAM), and file at reportfraud.ftc.gov. If you already gave card details, call your bank's number from the back of the card, ask to freeze and reissue, and watch for small "test" charges that scammers use before a big one. Acting within a day or two is what limits the damage.
Winning is free. The instant a "prize" wants your card to verify it, you haven't won anything — close the window and walk away.