What to Do After Giving Personal Information to a Giveaway Scam
Photo: Kaique Rocha / Pexels
Match each piece of exposed information with the right steps for securing accounts, credit, devices, and tax identity.
Stop communicating with the giveaway sender, provide nothing else, and secure every account, device, or financial record you exposed. Contact any affected bank or card issuer, then take additional steps based on the information you shared. A "free" offer can be a phishing tactic designed to collect personal information, which may later be used for identity theft.
Exposure does not prove that misuse occurred, but quick action can reduce the risk.
Verification note: Program terms and availability can change. This page was checked against linked sources on September 09, 2026.
Stop the contact and assess the exposure
Do not send another payment, verification code, password, photograph, or identity document. The IRS advises people who were deceived to end communication immediately and contact any affected financial institution through a trusted channel, such as the number on a card or statement in its guidance for scam victims. Write down what you disclosed and when.
Separate the information into practical categories: This inventory helps you focus on the accounts and protections that matter. Do not continue the conversation to ask whether your information was saved or deleted.
- Account usernames and passwords
- Bank, payment-card, or other financial details
- Social Security number or Individual Taxpayer Identification Number
- Access to a phone or computer
- Basic contact details, such as an email address or telephone number
Secure passwords and connected devices
If you disclosed a username and password but can still sign in, replace the password with a new, strong one. Change that password anywhere else you reused it, then enable two-factor authentication. If someone gained remote access to your phone or computer, update its security software, run a scan, and remove anything the scan identifies.
Change passwords and enable two-factor authentication after addressing the device. These steps follow the FTC's account and device recovery guidance. Prioritize accounts that contain sensitive messages, stored payment information, or other personal records.
If you cannot sign in, use the provider's normal account-recovery process rather than instructions sent by the giveaway contact.
Protect your credit and tax identity
If you disclosed your Social Security number, distinguish possible exposure from known misuse. The FTC directs people with confirmed identity misuse to IdentityTheft.gov and people who are uncertain to its data-breach recovery steps. Consider a credit freeze when someone could use your information to seek new credit.
A freeze is free, lasts until you lift it, and requires separate contact with Equifax, Experian, and TransUnion. A fraud alert is less restrictive: it asks lenders to verify your identity but does not block access to your credit report, as the FTC explains in its freeze and fraud-alert comparison. If your Social Security number or ITIN was exposed, you may also request a free IRS Identity Protection PIN.
This six-digit number helps prevent fraudulent federal tax returns, but you must retrieve a new PIN annually and use it on every federal return, according to the IRS IP PIN guidance.
Report the incident and expect follow-up attempts
After handling urgent account, device, and financial risks, submit a report at ReportFraud.ftc.gov. The FTC uses reports to identify patterns, support cases, educate consumers, and share local scam information. Be cautious if someone later promises to recover your money or obtain a refund.
Recovery schemes may impersonate agencies or law firms while requesting an upfront fee or financial information. The FTC warns that legitimate organizations do not require either to obtain a refund. Do not pay a supposed recovery service or provide new financial details because the caller already knows information from the original incident.