Is That Holiday Gift Card Offer in Your Inbox Real?

Almost certainly not, if it arrived unsolicited and asks you to do anything beyond reading it. Real retailers do not email strangers a free gift card, and the handful of legitimate holiday promotions that do exist live on the company's own site, under published rules, not in a message urging you to claim a prize in the next few hours. The mechanics are consistent enough that you can sort most of these in under a minute.

The question is never whether the email looks professional — the convincing ones look better than the real thing — but what the offer eventually asks you to hand over.

Verification note: Program terms and availability can change. This page was checked against linked sources on November 13, 2026.

The one question that settles it

Follow the offer to its end and see what it wants from you. The FBI's holiday scams guidance describes the core move plainly: a seller or a "support" contact asks you to send a gift card number and PIN, then drains the balance instead of applying it, and the goods never arrive. Any message that ends with you reading out card digits is the fraud itself, not a step toward a reward.

The second ending is a small payment. Researchers at the security firm KnowBe4 documented a multi-brand email campaign in May 2026 that promised phones, smartwatches and headphones for completing a "customer survey," then collected full card details behind a $5 to $10 shipping fee. The prize was never the point; the card number was.

Impersonated brands included Costco, Kroger, Sam's Club, Tractor Supply, FedEx, Marriott and AAA. So the test is not "does this look real." It is: does claiming this require me to give up card numbers, PINs, or payment details? If yes, stop.

A genuine promotion from a store you already shop at does not need your card to send you something free.

Why the email looks right

Two instincts fail here, and both are worth retiring. The first is that a message which cleared your spam filter has been vetted in some way. The same KnowBe4 research found the campaign rotated domains fast enough to slip past secure email gateways, which is exactly why these land in filtered corporate and consumer inboxes.

Arrival is not endorsement. The second instinct is that you can tell by looking at the landing page. The email security company Mimecast documented a UK campaign impersonating Boots and Superdrug in April 2026 that offered free gifts for fake satisfaction surveys and served near-pixel-perfect clones of the real brand sites.

Logos, fonts, layout, footer links — all correct. Visual inspection cannot separate a real reward page from a copy of one. What does separate them is where you started.

A page you reached by typing the retailer's address yourself, or by opening its app, is the retailer's page. A page you reached by clicking a link in an email is a page of unknown origin that happens to look familiar.

What this costs people

The FTC's analysis of gift card payments to scammers counted 39,263 reports totaling $147.8 million for January through September 2021, already ahead of the 36,682 reports and $115.1 million logged across all of 2020. The median reported loss in that period rose from $700 to $1,000. The same FTC data shows the demand is not brand-agnostic.

Target cards accounted for roughly $35 million — more than twice any other brand — and when scammers specifically asked for Target cards, the median loss reached $2,500. A request naming one particular retailer's card is a signal in itself, not a convenience. More recent federal figures put the broader category in context.

The FBI cites IC3's 2025 report showing non-payment and non-delivery losses above $503 million for the year, plus about $282 million in credit card fraud — the two buckets that absorb most fake-offer and fake-retailer losses.

A one-minute check before you click

Work from the company outward rather than from the email inward: If the offer turns out to be real, you lose a minute. If it is not, you lose nothing — and the check costs the same either way.

• Open the retailer's own app or type its address by hand. Amazon's anti-scam guidance states the company will never ask a customer to purchase a gift card, and that suspicious messages should be verified in the Amazon app or on its site, with reports sent to [email protected].
• Find the promotion on the company's site under its own official rules. No rules page, no promotion.
• Note whether the offer requires a payment of any size. Legitimate free offers and no-purchase-necessary entries do not take your card details for shipping.
• Separate a chance to win from a benefit you receive. A sweepstakes entry is a lottery ticket, not a gift card.
• Treat urgency as information. A deadline measured in hours exists to stop you from checking.

The physical cards on the rack

A second problem runs alongside the inbox version, and it affects cards you buy yourself. Wilton, Connecticut police arrested a man on November 10, 2026 after finding 36 gift cards along with tools for opening packaging, scraping the foil off PIN strips and resealing them. That method — known as draining — empties a card that was tampered with before you ever picked it up.

It is organized, not opportunistic. Texas Department of Licensing and Regulation investigators arrested four people on September 14, 2026 in a multi-state gift card tampering ring, with tampered cards representing over $100,000 in potential losses from a single day, charged under Texas Penal Code § 32.56. In practice that means handling the card the way you would handle a sealed product: check the packaging for cuts or re-glued edges, make sure the PIN strip is intact and unscratched, prefer cards pulled from behind a counter over ones at an open rack, and keep the receipt.

If you are giving the card, register or check the balance before it goes in the envelope — the recipient discovering a zero balance in January is the hardest version to resolve.

Frequently Asked Questions

I already sent someone a gift card number. What now?

Contact the card issuer immediately and ask whether the funds are still on the card — some portion is occasionally recoverable if you call within minutes. Keep the card, the receipt and the message, and report it to the FBI's IC3 and the FTC.

Does a message from the real company's domain mean it's safe?

A displayed sender name proves nothing, and the KnowBe4 research shows domains rotate too fast for filters to keep up. Verify the offer inside the company's own app or site rather than judging the message.

Is a sweepstakes that asks for shipping payment legitimate?

Treat it as a stop sign. The documented survey-reward campaigns used a $5 to $10 shipping fee specifically to capture card details, and a real no-purchase-necessary promotion does not bill you to deliver a prize.