Free Prize Scam: Why 'Just Pay Shipping' Is the Scam

A free prize that asks you to pay shipping, taxes or insurance is not a prize. The FTC states it in one line: real prizes are free. The fee is the product, and the checkout page behind it usually harvests your card number, address and identity data as well.

The version that spreads fastest carries no link, no price and no request for money in the post itself. It is missing everything a scam is supposed to have. That is the design, and it is why this one gets past people who would never click a suspicious link. What follows is one case from the post to the last payment, then the route the fifty dollars actually takes.

The case

Call her Grace. She is not one person. She is a composite, built from the pattern in complaints filed with the Federal Trade Commission and the Better Business Bureau about this exact scheme, and the amounts in her story are illustrative rather than reported. Every beat below happens, in this order, somewhere, every day.

Grace is sixty-one. She is in one of those neighbourhood Facebook groups where people give things away — old furniture, baby clothes, a lawnmower that mostly works. Her grandson’s birthday is in three weeks and a new console is not in the budget.

The post. Between a couch and a slow cooker, there it is. A mother writes that her son died last month, hit by a car coming home from college, that her heart bleeds every day, and that she bought him a console he never got to see. She wants it to go to someone who needs it. Message her. There is no link, no price and no request for money. Comments are turned off. She is from two towns over, and her profile checks out: years of photographs, a dog, comments about the weather.

Grace types the only thing a decent person types. I’m so sorry for your loss.

The reply. It comes fast, and it is gentle. Thank you for your kindness. She would rather the console went to someone kind. Then she asks for one thing, and this is the cleverest move in the whole script: she makes Grace promise not to sell it. Promise me you’ll keep it. For my son’s sake.

It sounds like grief. It works like a contract. Grace is not a shopper any more, she is the guardian of a dead boy’s memory. People walk away from deals every day. Almost nobody walks away from that.

The catch, small on purpose. She has moved away — she could not cope with the house. She will ship it overnight. Grace only needs to cover the courier. Around fifty dollars. For a five-hundred-dollar console, for a good reason, from a grieving mother. Who says no?

The first gear of the machine, visible if you look. The payment does not go to the mother. It goes to a payment app, addressed to a completely different name, somebody Grace has never heard of. My cousin handles the money right now. I can’t manage much. And she is asked to send it as friends and family, not as a purchase. Grace hesitates for about a second. Then the grief argues on the other side, and she sends it.

The ladder. The console ships tomorrow. Except tomorrow there is a problem: the courier requires insurance, sixty dollars, refundable on delivery. Grace has already promised. Already paid. Already pictured her grandson’s face. She pays again. Then a customs fee appears — on a package travelling two towns over.

Somewhere in there, Grace stops. And the moment she stops paying, the mother stops grieving. The thread goes quiet. The post is gone. The profile is gone. Grace is out a hundred and ten dollars she could not spare, and she got the cheap version of this scam.

The expensive version. In other runs of the same script there is no payment app at all. There is a link, to a professional-looking courier page that needs a card number to process the free shipment. Security researchers at Bitdefender have documented these pages collecting full card details including the security code, names, home addresses, phone numbers, even Social Security numbers, along with recurring charges the victim never authorised. On that path the fifty dollars was never the point. The card was the point. The identity was the point.

And the mother? She never existed. But the account did. It belonged to a real woman in another state, with a real history, who had been locked out of it months earlier. To understand why the machine needed her account rather than a new one, stop reading the post and follow the money.

How it works, step by step

Eight moves. Each does a job, and none of them requires the console to exist.

1. The post arrives without an offer. A death, a boxed gift, no link, no price, no request for money, comments disabled, interested people asked to send a private message. It works because your suspicion has nothing to attach to. There is no button to not click and no price to not pay, so the post never triggers the check you would run on an advert.
2. The words are not theirs. Malwarebytes documented the template in 2022, down to the sentence structure, replicated account to account with a single detail swapped — sometimes the son is a daughter. It works because a story that has been tested thousands of times outperforms a story someone wrote this morning. You are not reading a person. You are reading a control group’s winner.
3. The photographs are not theirs either. AAP FactCheck traced pictures used in these posts to real families, including images taken from a US childhood-cancer charity, Strong Little Souls, which said it had them removed many times. It works because the grief in the image is genuine, and you can feel that it is genuine. This industry does not fake emotion. It shoplifts it.
4. The account is often not theirs. In March 2024, 41 state attorneys general wrote to Meta about surging account takeovers; in New York alone, complaints rose from 73 in 2019 to 783 by the end of 2023, more than tenfold. It works because a brand-new profile posting a sob story gets ignored or removed within the hour, while a fifteen-year-old profile with a dog and weather comments gets believed. The stolen account is borrowed trust, aimed at the owner’s own neighbours.
5. Disabled comments remove the only reviewer. It works because the group, not the platform, is the natural defence here. Someone three streets over has seen this post before and would type so underneath it. Closing comments closes the one door the truth could walk through, and it looks like a grieving parent avoiding strangers rather than a control being switched off.
6. The private message manufactures an obligation. The item is promised to you, by name. You are asked not to resell it, out of respect. It works because it changes what backing out means. A decision becomes a betrayal, and the promise is extracted before any money is mentioned, so it never feels like part of a transaction.
7. The fee is small, and the smallness is engineering. Fifty dollars is inside the range where people approve rather than investigate. It works because interrogating a fifty-dollar courtesy costs more social discomfort than paying it, especially when the person you would be interrogating has just buried a child.
8. Then the fee has children. Insurance, refundable on delivery. Customs. A release charge. It works because the first payment reframes every later one: you are no longer deciding whether to spend, you are deciding whether to lose what you already spent. Each payment invents the next, and the sunk cost does the arguing.

Why a fifty-dollar scam is an industry

Fifty dollars looks too small to be a business until you count what sits behind it. The words are a text file. The photographs are stolen. The accounts are a commodity supply chain big enough to summon forty-one attorneys general. Posting costs nothing, and the item being given away does not exist, so there is no inventory, no shipping and no cost of goods. Every fee collected is margin.

The FTC counted $2.1 billion reported lost in 2025 to scams that started on social media, eight times the 2020 figure, with nearly 30% of everyone who reported a fraud loss that year saying it began on social media — and more money lost to scams that started on Facebook than on any other social platform, which is exactly where neighbourhood groups live.

Does engaging cost you anything, if you are careful?

The Better Business Bureau’s number answers that better than advice can. Of the online purchase scams reported to its Scam Tracker in 2024, 87.5% came with a dollar loss, and that category was 30.3% of everything reported. Engaging with one of these posts is not a neutral act you can back out of at leisure. Close to nine in ten of the people who got far enough to file a report had already paid.

Where the money goes

This is the part the post is designed to keep you from thinking about.

Rail one: the peer-to-peer app, in a stranger’s name. Grace’s fifty dollars does not fly straight overseas, because payment apps mostly do not work that way across borders. It lands with a collector inside her own country: an ordinary person with an ordinary payment-app account, who takes a cut, converts the rest into cryptocurrency, and forwards it on. The FBI has a name for that middleman — a money mule. That is the whole answer to why the name on the payment never matches the name on the post. The cousin who handles the money was the cash-out desk.

Why that rail and not a card. Because of what you can do afterwards. PayPal states plainly that Friends and Family payments are not covered by Purchase Protection, which means there is no dispute to open. The FTC’s list of methods scammers insist on is the same list every time — wire transfer, payment app, cash, gift card, cryptocurrency — and they share exactly one property: no recourse. Asking for that rail is not a preference about convenience. It is a decision about your options later, made before you paid.

Rail two: the card itself. On the courier-page version, the money is not the product. The card number with its security code, the address, the phone number and, Bitdefender documented, sometimes the Social Security number are the product — sold or used, plus recurring charges the victim never agreed to. That is why the loss on this path keeps arriving months after the console did not.

What it costs at national scale. The FBI’s official category for paying and never receiving, non-payment and non-delivery, accounted for $503,373,587 across 56,478 complaints in 2025, inside a total of $20.877 billion reported across 1,008,597 complaints.

Why irreversible is the whole point. A card charge can be reversed by a bank that never has to ask the seller’s permission. A Friends and Family transfer cannot. Crypto cannot. A gift-card code, once read aloud, cannot. Every rail on that list moves the decision about your money from an institution that owes you a process to a stranger who owes you nothing.

How to spot it

Seven signs, each with a test that takes under a minute.

1. Free that charges is not free. The FTC’s language is exact: “Real prizes are free.” Test: name the charge out loud — shipping, handling, tax, insurance, processing, customs. Any of them ends the conversation. There is no version of this rule with an exception in it.
2. Comments are off and you must send a private message. Test: look for the group’s own history. Search the group for the same item or the same phrase. Disabled comments on a giveaway are not privacy, they are a removed reviewer.
3. Run the sentence test — twenty seconds, and it settles most of them. Test: copy one full sentence from the post, put it inside quotation marks, and search it, in the platform and in a search engine. The same bereaved parent appears in dozens of towns, sometimes with the child’s gender changed. This works because the strength of the template is also its signature.
4. Run the picture back. Test: reverse image search the photograph. It usually surfaces the child, the room or the boxed console somewhere it was taken from — a charity page, a stock library, another family.
5. The payment method is the confession. Test: ask to pay by card, or through the platform’s own protected checkout. A genuine person shipping you a real object has no reason to refuse. Refusal is the answer.
6. The name on the payment does not match the name on the post. Test: read the recipient field before you approve, and treat any mismatch as final, whatever the explanation. That is a mule account, and the explanation is always a relative.
7. A delivery page is asking for card details you would not give a courier. Test: ask what a courier could possibly need. Legitimate delivery never needs your card’s security code, and it never needs your Social Security number. Never type card details into a page you reached from a message.

The one thing the machine cannot change

Scripts get rewritten, photographs get swapped, accounts get replaced weekly. The fee cannot be removed, because the fee is the revenue. Every variant of this scam — console, phone, puppy, concert tickets, furniture — has to arrive at the same sentence: you just need to cover something small. Learn that sentence and the surface details stop mattering.

What to do if it already happened

In this order.

1. Stop paying. The insurance charge, the customs charge, the last one before delivery. None of them is the last one, and the item does not exist.
2. Call your bank or card issuer today and use the words fraud and dispute. If you paid by card you have a chargeback path and it is time-limited. If you paid through a payment app, report it inside the app and to the bank behind it, and ask them to attempt a recall.
3. Report to the FTC at reportfraud.ftc.gov. This is the consumer-protection intake. It does not chase your individual payment; it feeds enforcement and the national loss data — the $2.1 billion figure above exists because people filed.
4. Report to the FBI at ic3.gov. IC3 is the intake for internet crime, and the non-delivery category above is where your case lands. Include the recipient’s name on the payment, the app used, the amount and the profile URL.
5. Report to the BBB Scam Tracker. This one is public, which is its point: your report becomes something the next person finds when they search the same phrase.
6. If your card touched a courier checkout page, treat the card as compromised and have it replaced, then watch statements for small recurring debits rather than one large charge.
7. If you gave out personal data, including a Social Security number, work through identitytheft.gov for a recovery plan, and place a fraud alert with the credit bureaus.
8. If the post came from someone you know, contact them another way — phone, in person, a different app. Their account was probably taken over, they are locked out, and they are being used as the mask on their own friends.
9. Report the post and the profile to the platform. It costs nothing and it is the only signal that reaches the takedown pipeline. Meta says it removed over 159 million scam ads in 2025 and 10.9 million accounts linked to criminal scam centres, with 92% of those ads removed before anyone reported them, plus more than 150,000 accounts disabled in a joint operation with the FBI and the Justice Department’s scam-centre strike force.

Enforcement at that scale mows the lawn. It does not pull the roots: the FTC’s loss line still multiplied eight times over five years while all of that was happening. Which is why the last step matters most.

How to not be next

• Adopt the FTC’s sentence as a rule with no exceptions. Real prizes are free. If money moves toward the giver, it is not a gift.
• Never send a payment as friends and family to somebody you have not met. That setting is a legal position, not a formality, and you are giving up the only process that would have helped you.
• Spend the twenty seconds before, not after. One sentence in quotation marks, one reverse image search. Both are faster than typing a message.
• Treat a mismatched payee name as the end. No further discussion, no explanation accepted.
• Assume a compromised account rather than a bad neighbour. When a familiar profile behaves strangely, verify on another channel — which protects them as well as you.
• Show your parents and your grandparents the sentence test this week. Not a lecture. Twenty seconds, once. That is the whole conversation, and it transfers to every future version of this post.

The numbers, and what they mean

• The FTC counted $2.1 billion in reported losses to scams that started on social media in 2025, eight times the 2020 figure, and reported that nearly 30% of people who lost money to fraud that year said it began on social media, with more money lost to scams that started on Facebook than on any other social platform (FTC Data Spotlight, April 2026).
• The FBI’s official category for paying and never receiving accounted for $503,373,587 across 56,478 complaints in 2025, inside a total of $20.877 billion across 1,008,597 complaints (IC3 2025 Annual Report).
• Online purchase scams were 30.3% of everything reported to the BBB Scam Tracker in 2024, and 87.5% of the people who reported one lost money (BBB Institute 2024 Risk Report). Close to nine in ten. Engaging is not a neutral act.
• In March 2024, 41 state attorneys general wrote to Meta about account takeovers; in New York, complaints went from 73 in 2019 to 783 by the end of 2023 (multistate letter). Stolen profiles are the infrastructure this scam runs on.
• Meta says it removed over 159 million scam ads in 2025 and 10.9 million accounts associated with criminal scam centres, 92% of the ads before anyone reported them, and disabled more than 150,000 accounts in a joint disruption with the FBI and the Justice Department’s scam-centre strike force (Meta Newsroom).
• The rule that ends every version of this, in the FTC’s own words: “Real prizes are free.” And the payment methods it says only a scammer insists on: wire transfer, payment app, cash, gift card, cryptocurrency (FTC Consumer Advice).
• PayPal states that Friends and Family payments are not covered by Purchase Protection (PayPal). That is the whole reason it is the requested rail.

Watch the full documentary

The full case, the money trail and the four fingerprints are in the documentary: Don’t Take the “Free” PS5 from a Grieving Stranger.

Related

When the free gift is offered by a famous face instead of a grieving stranger, it is the celebrity crypto giveaway deepfake. When the borrowed trust is a brand rather than a person, it is the fake Microsoft security alert. And the same fee-to-release trick, scaled into the billions, is how the pig butchering scam closes. The same small, payable figure — set low enough to be paid rather than questioned — is why the virtual kidnapping call asks for two thousand dollars and not for a million. And when the cheap offer buys a visit instead of a parcel — a $39 special that ends in a four-figure invoice — it is the air duct cleaning scam.