If you have not received a couple – or a few dozen – of notifications through Instagram announcing that you have been lucky enough to win an iPhone 13 in a raffle in which you had not participated, surely it has happened to your friends and acquaintances.
"It has come to me a thousand times, I don't want to win more iPhones," cries a user of the platform.
In recent weeks, this campaign has spread among users in Spain, but also among those in countries such as the United Kingdom, Ireland and France.
The scam strategy is the same: find a way to get users to click on a link and, ultimately, add their bank card number.
More information
This is an 'online' fraud step by step: "I wanted to break his legs, but he wasn't even who he said he was"
The
modus operandi,
in this case, consists of a profile with a name of Slavic origin that includes a series of photographs of various people posing in an Apple store while holding an iPhone 13 case in one hand and, in another, a receipt that marks €2.
In these images they tag random users, who announce that they are the lucky ones to receive the prize.
Next, they indicate another profile to which they must access to find a link that will take them to a survey that they must fill out in order to receive the prize.
That questionnaire is very simple;
The problem comes when the potential victim is asked to include her bank account number to deposit a small amount.
Capture of one of the accounts that tagged the alleged winners of an iPhone 13.
That small amount could be charged every month, for example.
And of course you will never receive the iPhone.
As explained by Josep Albors, director of research and awareness of the computer security company ESET in Spain, the iPhone 13 is nothing more than the hook: “What they are looking for is something that is powerful enough for people to click on the link .
That's where the deception begins."
Albors recalls how on other occasions the name of local brands has been used despite the fact that the plot is orchestrated from another country: “They prepare templates for different countries.
We have seen campaigns using supermarkets that are only here.
They use trademarks over which they have no rights;
over anything that is catchy enough for the user to click on the link.
Misuse occurs without permission,
The key to multiplying these campaigns is found in affiliate
marketing
: a company pays other companies or other individuals if they get users to access their website or certain content.
In other words, in order for them to obtain money, it is not even necessary for the potential victim to provide their card number;
just by clicking on the link you are already contributing to the business.
That would explain why the account you mention tells you to access a second profile that contains a link that sometimes redirects to another place.
“They move in a gray area and if they see that there may be a problem, they may close the company and open another.
There are companies that engage in this type of
marketing.
Behind this, more than cybercriminal users, most of the time there are companies”, warns Albors, and insists: “As a user clicks once on the link, it is possible that they receive many more similar communications, because these campaigns are repeated and reproducing”.
Screenshots of the website to which the profiles announcing the giveaway redirect: one of the survey questions and the alleged user comments are shown.
The profiles that advertise these giveaways have a very ephemeral life.
Some don't last more than a few hours active, usually because users they've tagged or followed report them to Instagram.
The platform itself recommends that, in the slightest doubt of deception, they report it in the menu of the publication or profile they suspect: "Do not trust messages in which they offer you money, gifts or threaten to delete your account" , he warns.
Precisely because they mention so many users and many end up reporting the accounts, if one wanted to go back to one of those profiles, it would probably no longer exist.
“This week I have blocked eight”, comments another user to this newspaper.
Although, this time, the campaign has become popular on Instagram, it is common that they are also spread by email.
The National Institute of Cybersecurity (INCIBE) warned a couple of months ago about the spread of a
phishing
attempt (a deception posing as a real company or entity) through email also with alleged iPhone 13 giveaways.
From INCIBE they recommend restricting the privacy settings of social accounts as much as possible: "The more information we expose, the more risks we are going to run", warns Ángela García Valdés, Cybersecurity technician for Citizens of the organization.
That's why experts advise keeping your profiles private and, whenever possible, changing your settings so you don't receive messages or mentions from people you don't follow.
The entity recalls that, in addition, users have a free telephone number (017), among other means of communication, to consult any doubts that may arise in these and other cases.
Still, not all sweepstakes advertised on social media are fake.
The key to determining its veracity is to verify that the person who communicates it is the official and true company.
“You have to see if it has been organized by a recognized company, reviewing, for example, its other social networks.
If we don't find anything, chances are there is no such draw.
We can also review the URL or web address, since many times they only add a few characters so that we do not easily notice the difference.
You have to use common sense and play detective”, insists Valdés.
You can follow
EL PAÍS TECNOLOGÍA
on
and
or sign up here to receive our
weekly newsletter
.
Exclusive content for subscribers
read without limits
subscribe
I'm already a subscriber
