How to Spot a Fake Holiday Sweepstakes Email

By · · Category: Safety & Security
How to Spot a Fake Holiday Sweepstakes Email

Learn the warning signs in holiday win emails and the checks to use before you click, pay, or reply.

A fake holiday sweepstakes email usually claims you won a prize you never entered, then asks for money, personal data, or fast action. You can spot it by checking entry, payment demands, sender address, and pressure to click. A sweepstakes is a free drawing where winners are picked by chance.

Holiday inboxes are crowded, which makes surprise win notices harder to judge. A short pause and a few checks can help you decide what to do next.

Verification note: Program terms and availability can change. This page was checked against linked sources on November 02, 2026.

Did you enter it?

According to the Federal Trade Commission, a notice that you won a sweepstakes you never entered is a prize-scam warning sign, described in its prize-scam guidance. Treat an unexpected holiday win email with that same caution. Search your inbox for an entry confirmation before you believe the win.

The Federal Trade Commission also states that legitimate sweepstakes are free and won by chance. It is illegal to require payment or purchase to enter or to improve odds. If you never submitted an entry, there is no prize to release.

A simple test helps. Did you enter on the sponsor's known domain, save a confirmation, and recognize the prize name. If not, do not reply with personal data.

Does it demand payment to release the prize?

The Federal Trade Commission states that real prizes are free. Any demand to pay taxes, shipping and handling, processing fees, or customs duties to release a prize points to fraud. A prize that costs money to claim is not a prize.

Only scammers insist on wire transfer, gift card, cryptocurrency, bank transfer, or payment app to claim a prize or fix a problem, according to the Federal Trade Commission as relayed in its payment-scam alert. Holiday messages often frame this as urgent verification.

  • taxes or customs duties paid by wire or bank transfer
  • shipping, handling, or processing fees paid by gift card
  • release or insurance fees paid by crypto or payment app

Does the sender and message look wrong?

Phishing emails often use a look-alike sender address, generic greeting, missing contact details, urgency, links, attachments, and requests for personal data, according to the Cybersecurity and Infrastructure Security Agency in its phishing guidance. A holiday subject line does not change those signs. Read the sender address letter by letter.

Do not click, download, or reply to test it. Note the sender address and delete the urge to act fast.

  • address that mimics a known brand with extra letters or numbers
  • greeting such as Dear Valued Customer
  • missing signature contact details plus urgent deadline
  • links, attachments, or forms asking for personal data

Why do foreign wins and holiday deals need extra pause?

The U.S. Postal Inspection Service states that a U.S. notice of winning a foreign lottery or sweepstakes is almost always fraud.

Federal law bars playing a foreign lottery by mail or phone. A holiday email claiming a foreign jackpot fits that pattern. The FBI notes that older adults face disproportionate targeting by sweepstakes, lottery, romance, tech-support, and government-impersonation scams.

It also advises holiday shoppers to distrust deals that seem too good to be true. A luxury trip, car, or large gift card for no entry deserves doubt.

How do you check and report it?

The Federal Trade Commission explains in its ReportFraud FAQ that reports go to the Sentinel law-enforcement database and that it awards no prizes. Forward or report the email to ReportFraud.ftc.gov and FBI IC3. Verify through the sponsor's known domain without clicking the email.

Close the email and start fresh in your browser if you want to verify the promotion.

  • do not click links, call listed numbers, or send money
  • save the full message for reporting
  • open a new tab and type the sponsor's known domain yourself
  • report, then delete the message

More from the blog