Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Check a prize notification

    Recognise when a promised prize turns into a request for money or information.

    Users of financial servicesAbout 5 minutes of reading + 3 questions
    Start with the example Need to act now?

    What you will learn

    • Verify a prize draw with its organiser.
    • Recognise a risky payment or information request.
    • Act if you have already paid or completed a form.

    Practice example

    Does a small fee change the risk?

    A message using a familiar shop’s logo
    Today, 09:41

    Congratulations, you have won a phone! To reserve delivery, pay a small fee today and enter your card details.

    Fictional training example.
    Show the example explanation
    You have not verified the organiser
    A logo can be copied. Check the promotion through the shop’s official channel.
    Payment before a prize
    A supposed fee to release a prize is a serious warning sign.
    Card details
    The risk is not limited to the small fee if you enter sensitive details into an unverified form.

    What is the scam trying to achieve?

    The message promises a prize to persuade you to pay a supposed fee or share information. It may arrive by email, text or social media and use a familiar shop’s name. Entering a real promotion does not authenticate a new message.

    Check before opening a form

    1. Consider which draw you entered and who organised it.
    2. Open the organiser’s official website or a known contact independently of the message.
    3. Check whether this particular promotion and prize notification match the published rules.
    4. Do not pay an unexpected fee to supposedly release a prize or send PINs, passwords or one-time codes.

    Demands for payment first and pressure to respond quickly are common patterns in prize scams.

    Why is appearance not enough?

    A logo, signature and familiar name can also appear in a fake message. Follower counts or positive comments alone do not confirm a sender’s identity. The key is to check the request outside the channel that sent the offer.

    You do not have to decide within the message’s deadline. If you cannot confirm the organiser or promotion, do not enter information or continue the conversation as a test.

    If you have already paid or shared information

    If you paid or exposed card details, contact your bank immediately through an official channel. Keep the message, page address and payment receipt. Do not wait for the prize to arrive before checking an exposed card.

    If you shared a password, follow the account recovery guide. If you sent personal details or a document, read about signs of identity misuse.

    Report the suspicious profile or message to the platform. You can report a cyber incident to FIN-CSIRT; this does not replace contacting your bank. After preserving the evidence you need, block the sender. Reimbursement is not guaranteed.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    A message says you have won a phone, with a small delivery fee. What do you do?

    Why does this matter? The promised prize draws attention away from the fact that you provide money or information first. A small fee can seem harmless although the form requests details that could be misused for a larger amount.

    1. Do not pay and independently check the promotion with the organiser.Correct answer

      Independent verification does not require using the link in the suspicious message. You check whether the promotion and its terms actually exist before disclosing information or paying.

    2. Pay because the amount is small.

      A small amount may be bait for information or further payments. The size of the first charge does not limit what someone may attempt with the details you hand over.

    3. Enter my card, expecting that I will not be charged immediately.

      Entering details on a fake page can expose them. A fake form can collect what you type, so do not rely on a later step as the point at which protection matters.

    You did enter a real prize draw. A new message asks for your card PIN to confirm the win. What is best?

    Why does this matter? Genuine participation makes a message more convincing, but does not establish its sender. A PIN is a card-use secret, not evidence that you are entitled to a prize.

    1. Send the PIN because I entered.

      Having entered does not authenticate a new message. This links two separate things: your earlier participation and the authority of the person now requesting a secret.

    2. Send only part of the PIN.

      Do not send even part of a PIN to an unverified person. Partial disclosure still reduces secrecy; a suspicious request calls for verification, not negotiation over how much to reveal.

    3. Do not share the PIN and check through the organiser’s official channel.Correct answer

      You check the request without exposing a secret. You keep the PIN secret while establishing whether the organiser is behind the message at all.

    You entered card details into a suspicious prize form. What is your first step?

    Why does this matter? Details entered into a fake form may remain with its operator. Removing the message from your phone does not remove that copy or the possibility of attempted misuse.

    1. Delete the message and move on.

      Deletion does not withdraw information from the fake page. You lose a useful record without regaining control of the card details.

    2. Contact my bank immediately through an official channel and explain what I entered.Correct answer

      The bank can assess which protective steps the card needs. An accurate account of the information entered helps the bank choose measures suited to the actual exposure.

    3. Wait to see whether the prize arrives.

      Waiting delays protection of exposed information. Prize delivery and card protection are separate issues; protection should not wait for a promised delivery.

    No registration. Your answers are not sent; the result is just for you.

    Remember

    A promised prize is no reason to skip verification or pay an unexpected fee.

    Recognise a financial scam

    References

    Sources and further reading

    Recognition of fake prizes and unexpected payment demands is based primarily on the Serbian National CERT warning about online scams. The FTC guidance on fake prizes and lotteries (United States) supplements common signals; US reporting routes are not part of this lesson.

    Content last reviewed