Social Media Prize Draws and Impersonated Lottery Accounts

Prize fraud went where the audience went. Mega Millions lists social media alongside email and phone in its description of how criminals make contact, and warns that scammers "are fraudulently using our name and our logo" (Mega Millions, Lottery Scams).

The platform matters because of what it changes. An impersonated email domain is checkable in the header. An impersonated account looks exactly like the real one, sits inside a feed you already trust, and can message you first.

The scale, stated carefully

The FTC's Consumer Sentinel Network Data Book 2024, covering calendar year 2024, breaks fraud reports down by contact method. Of the 1,509,002 fraud reports where a contact method was identified:

Social media produced the largest total reported losses of any contact method — $1,858 million — despite ranking fourth by report volume. Per report, that is roughly $9,900 against about $1,350 for email.

An important caveat: this is all fraud, not prize fraud specifically. The FTC does not publish a social-media breakdown for the prize, sweepstakes and lottery category alone, so nobody can honestly tell you what share of lottery scams arrive by DM. What the table supports is narrower and still useful: when fraud reaches people through social media, it costs them more. The prize-fraud figures themselves are in the FTC data article.

The four shapes it takes

1. The impersonated operator account. A profile using a real lottery's name, logo and colours, posting real results and real jackpot figures — all of which are public — to build a credible history. It then messages "winners" directly.

2. The engagement draw. A post promising entry to a prize draw in exchange for a follow, a like, a share and a comment. Sometimes the account is impersonating an operator; sometimes it is a generic "giveaway" page. The prize does not exist; the objective is an audience, which is later sold or repurposed.

3. The reply-hijack. Under a genuine operator's post, an account with a near-identical name replies to commenters offering to "process" a prize. People who followed a legitimate post end up in a conversation with an impostor without ever leaving the platform.

4. The generous-winner impersonation. This one is specifically documented. Mega Millions warns that scammers "may even claim to be prior Mega Millions jackpot winners who are sharing their prize money."

It works because the premise is real. Tom Crist gave away a C$40 million jackpot, and Allen and Violet Large gave away about 98% of C$11.3 million. Those stories are true, well documented, and exactly the reason the impersonation is persuasive — and the Larges' names were themselves used in fake prize notifications after their win. Genuine large-scale giving runs through foundations and named charities with public records, never through unsolicited direct messages.

How to check an account is genuine

The method reverses the direction of travel. Never go from the account to the operator. Always go from the operator to the account.

The reliable check, in order

1. Type the operator's website address yourself. Not from a search result, not from a link in a post.
2. Follow the social links published on that site. Whatever accounts the operator links to are its accounts. Anything else is not, however convincing.
3. Confirm the operator is real and licensed on a public register — the Gambling Commission's, the MGA's, ACMA's, or the WLA and NASPL member lists for state lotteries.
4. Apply the substantive test regardless. Even a genuinely verified operator account will never tell you that you have won and ask for a fee. No real lottery contacts winners at all, which means a genuine account cannot produce a genuine win DM.

That fourth step is the one that makes the others almost redundant. If the message asks for money or bank details, its authenticity is irrelevant.

What does not work

• Verification badges. On several platforms these are now purchasable rather than earned, so a badge no longer certifies identity. Treat it as decoration.
• Follower counts. Purchasable.
• Screenshots of "previous winners". Free to fabricate, and often lifted from real coverage of real winners.
• The handle looking right. Substituted characters, added underscores, doubled letters and different top-level domains are all standard. Compare against the operator's published handle character by character rather than by impression.
• The account replying quickly and knowledgeably. Results, jackpot amounts and draw times are all public.

Weaker signals still worth a glance

Account creation date, whether posting history predates the current jackpot run, whether the account follows and is followed by other official bodies, and whether the same content appears under several near-identical handles. None of these is decisive; all of them are quick.

Why the DM is the giveaway

Real lottery operators broadcast. They publish results, jackpot levels and winner announcements to everyone at once. What they do not do is initiate a private conversation with an individual about a prize — because, as covered in why no lottery notifies by email, a retail ticket carries no identity and the operator has no way of knowing which account belongs to which ticket holder.

So the structural rule is short: a public post can be genuine; an unsolicited private message about a win cannot be.

The prize-draw variants that are not lotteries

Not every social prize draw is a lottery scam. Legitimate promotional competitions exist, and the FTC sets out what the real ones must look like: real sweepstakes are free and by chance, and "it's illegal to ask you to pay or buy something to enter or to increase your odds of winning" (FTC).

The FTC also flags two things about legitimate promotions that are worth knowing before entering: promoters may sell your information to advertisers, and skills contests — where you answer questions or solve problems — can legally charge, with each round getting harder and more expensive.

So the boundary is: free to enter and chance-based means it may be legitimate; pay to enter or pay to improve your odds means it is either a skills contest or a scam, and in either case is not the free prize draw it looked like.

If you have been targeted

Report it twice: to the platform, which can remove the account, and to your national fraud reporting body, which feeds enforcement. Both routes are listed in what to do if you have been targeted.

And if you have already engaged, stop replying rather than arguing. Mega Millions notes the practical reason: engaging can put your details on a list circulated to other operations.