Before You Hit Enter: A Ten-Point Inspection for Holiday Giveaway Links
Every November my group chat fills with the same forwarded post: a photo of a stand mixer, a suspiciously generic "Apple bundle," and a caption begging everyone to enter before midnight. Some of those links are perfectly legit. Others want my street address, my birth date, and permission to text me until 2029.
The gap between the two is almost always visible in about ten minutes, using tools that cost nothing. This is the routine I run before I type an email into any prize form, and it has saved me from at least four obvious harvesters this season alone.
Why the holidays are peak harvesting season
Scam volume tracks shopping volume. From Black Friday through mid-December, brand impersonation posts spike because that is when people are primed to believe a retailer is giving something away. Facebook and Instagram pages get cloned, prize photos get lifted from legitimate 2019 campaigns, and a throwaway domain goes live with a form that collects names, phone numbers, and mailing addresses in bulk.
The good news: fake giveaways are lazy. They cut corners on the same five or six things every time, and each of those corners is detectable.
1. Expand the short link first, always
Never click a bit.ly or t.co wrapper straight into a form. Paste it into wheregoes.com or urlex.org and read the redirect chain. A legitimate promo usually bounces through the brand's own tracking domain and lands on the brand's own site. If the chain ends on spring-prize-center.shop or something with a hyphen and a random noun, close the tab.
2. Run a WHOIS lookup on the domain
Go to lookup.icann.org or whois.domaintools.com and check the registration date. Domain age is the single most useful signal in this whole checklist. A sweepstakes running on a domain registered five weeks ago is not a brand campaign; it is a rented storefront. Real brands run promos on ten-year-old domains. Privacy protection on the WHOIS record is normal and not itself a red flag, but the creation date rarely lies.
3. Read the domain letter by letter
Typosquatting is everywhere. I have seen homedepotsurvey-rewards.com, amazon-wins.co, and a fake Costco page on a .top domain. The padlock icon means nothing here; HTTPS is free and scammers buy it in bulk. Look at the characters, not the logo.
4. Reverse-image search the prize photo
Drop the prize image into Google Lens or TinEye. If the exact same photo shows up on a dozen coupon blogs from 2020, it was lifted. Genuine 2026 campaigns usually feature current product shots, branded creative, or at least a photo that only appears in connection with that sponsor.
5. Interrogate the social account
On Facebook, open the Page transparency panel and check the creation date. A page that is eleven weeks old, has 40,000 followers, and zero comments on its posts bought that audience. On Instagram, scroll to the earliest posts. Real brand accounts have years of archive. Also check the ratio of comments to followers; engagement is expensive to fake and scammers usually skip it.
6. Locate the Official Rules and read the sponsorship line
Every legitimate US sweepstakes has Official Rules, usually linked in the footer or in the post itself. They should name a sponsor entity, list eligibility (often 18+, US residents, void where prohibited), give a start and end date, state the approximate retail value of the prize, and include the magic phrase "no purchase necessary." If the only thing on the page is a form and a countdown timer, that is your answer.
7. Check registration or bonding where it applies
A handful of states, New York and Florida most notably, require sponsors to register or bond larger sweepstakes, and Rhode Island has its own rules. A sponsor that mentions a registration number in its rules is a sponsor that talked to a lawyer. That is a good sign, and its absence is not automatically bad, but it is worth a glance.
8. Ctrl+F the privacy policy for sharing language
Open the policy and search for "share," "partners," "third parties," and "sell." Standard language about service providers is fine. Language saying your information may be shared with marketing partners or used for telemarketing is the actual product being given away, and it is not you winning.
9. Look hard at what the entry form asks for
Name, email, ZIP code, and a checkbox: normal. A date of birth is common for eligibility. But a Social Security number, bank details, a photocopy of your ID, or a credit card "for verification" before you have won anything is never legitimate. Prize fulfillment requests that kind of documentation only after a verified win, and it comes from a named fulfillment agency, not a Google Form.
10. Search the sponsor name plus the word scam
Last step, lowest effort. Search the brand name with "sweepstakes," then again with "scam." Skim Reddit threads, the Better Business Bureau, and the sponsor's own winners page. Real campaigns publish winner lists, because state law often requires them to. A sponsor with no winners page, no rules archive, and a domain younger than your car is not running a sweepstakes.
The walk-away list
If two or more of these are true, I am out: domain under a year old, no named sponsor in the rules, prize photo appears on unrelated sites, form asks for a phone number and address before a win, page demands a share or tag to "unlock" the prize, or the only way to enter is by submitting a review or payment.
What to do when a link passes
Most of them do, honestly. Plenty of legitimate brands run holiday promos through real agencies, and the checklist takes less time than reading a terms-of-service page you were going to skip anyway. Once a link clears all ten, enter it without guilt, but use an address that isn't your main inbox. That is the other half of the strategy, and it is the reason my real email stays readable through December.
