A fake rules website borrows the look of official terms for a gaming, betting, sweepstakes, or contest offer. Its real target may be your password, payment details, one-time code, or identity information.
Check the offer from a known starting point. Open the brand's official app or type its established website address yourself, then find the rules there. A polished design and an unexpected link prove nothing.
Already entered information? Close the page and stop interacting with it. Then work through the recovery steps below.
Why scammers copy rules pages
"Rules" sounds routine. An eligibility notice, promotion, or account update can feel like ordinary customer information rather than a phishing attempt.
The copy may include the brand's logo, colors, legal wording, and even a chat feature. Small errors are easy to miss when the page looks familiar.
The scammer doesn't need to recreate the whole service. The page only has to hold your attention long enough for you to submit one useful detail, sometimes several.
A message, search result, social post, or QR code can send you there. The FTC's phishing guidance warns that scam QR codes may lead to fake sites built to steal money or personal information.
Red flags on a fake rules website
One clue may have an innocent explanation. Several together should end the visit.
| What you see | Why it deserves suspicion | Safer response |
|---|---|---|
| A domain with misspellings, extra brand words, or an unfamiliar ending | It may imitate the real company without being connected to it | Open the known official site or app instead |
| A form asking for a password, one-time code, bank login, SSN, or full card number just to read the rules | The request doesn't fit the page's stated purpose | Close the page and verify through official support |
| A countdown, threat, or urgent eligibility warning | Pressure can rush you past ordinary checks | Stop and take time to confirm the message |
| A QR code or several redirects | The final destination may be hidden | Don't scan it; find the page independently |
| Blurry logos, strange wording, or inconsistent names | Copied branding often contains small errors | Compare the page with the official site |
| A payment or "processing fee" to unlock rules, prizes, or refunds | It may be an advance-fee scam | Pay nothing until the offer is verified |
| No clear privacy information or legitimate support route | The operator may be avoiding identification | Use contact details from the official site only |
Thing is, a genuine promotion may use an outside company to host its rules. A different domain isn't automatically fraudulent if the official website links to it.
HTTPS protects the connection, not the operator. The padlock alone can't establish that the page is legitimate.
How to verify a rules page before entering information
Use this check before you type anything:
- Pause. Don't download a file, approve a login, or call a number shown in the suspicious message.
- Start from a known source. Type the brand's established address yourself or open its official app. A search result, advertisement, or message link isn't verification.
- Follow the site's navigation. Look under Rules, Promotions, Terms, Help, or Support. If the official site sends you to a third-party rules host, confirm that the link really appears on the official site.
- Match the request to the purpose. A rules page may explain entry information. It shouldn't demand a bank login, password, or one-time security code merely to display its terms.
- Contact the company separately. Use a phone number or support page found on the official site, your card, or an account statement. Never use contact details supplied by the suspicious page.
- Leave if you're still unsure. You don't have to identify the operator before protecting your information.
What to do if you clicked or submitted information
A click by itself doesn't show that your device is infected. The risk is greater if you entered credentials, downloaded a file, approved an account prompt, or sent money.
- Password or one-time code: Change the password from a trusted device, sign out of other sessions, and turn on two-factor authentication. Tell the affected service that your login information may have been exposed.
- Card or bank details: Call the issuer or financial institution using the number on your card, statement, or official app. Ask whether the card or account should be blocked or replaced.
- Identity information: Watch for unfamiliar account activity and tell the relevant financial institutions what happened. Keep a record of each conversation.
- Downloaded file or remote access: Disconnect the device if necessary, run a trusted security scan, and get help from a reputable technician. Don't let the scammer "fix" the problem.
Preserve screenshots, the exact page address, the original message, sender details, dates, transaction records, and confirmation numbers. Save them before deleting anything. Don't reopen the page just to gather more evidence.
Your payment method changes the recovery path
The next call depends on how the money moved.
For a debit card or bank account, contact the bank or credit union's fraud department immediately. Tell them whether the transaction is pending, completed, or only suspected, and ask which dispute process and deadline apply.
Credit card payments follow a different route. Call the card issuer, explain that the transaction followed a phishing incident, and follow its instructions about a billing dispute, card replacement, and supporting documents.
Wire transfers, peer-to-peer payments, gift cards, and cryptocurrency each involve a provider as well as your financial institution. Contact both at once and ask whether a hold, recall, freeze, or reversal remains possible. Don't send more money to cover a supposed recovery fee.
For U.S. consumers, 12 CFR 1005.6 sets liability rules for certain unauthorized electronic fund transfers. If you notify the financial institution within two business days after learning that an access device was lost or stolen, liability generally can't exceed the lesser of $50 or the unauthorized transfers made before notice.
Waiting longer can increase potential liability. The rule also includes a 60-day statement period that may matter.
That rule isn't a universal refund promise. It addresses unauthorized electronic fund transfers, and the facts may differ if a scammer persuaded you to approve a payment or share a security code. Explain exactly what happened and ask the institution which process applies.
Where to report a rules scam website
Send the website, message, and payment details through the FTC's fraud reporting form. The report may help the agency identify patterns, but it doesn't replace a call to your bank or card issuer.
For internet-enabled crime, file with the FBI's IC3 complaint form. Include the fake page address, how you found it, the information you entered, payment details, and related account names or messages.
Report the original email, text, social post, advertisement, or QR code to the service where you saw it. That can help remove the same link before it reaches more people.
To be honest, reporting still helps even if you lost no money. Keep confirmation numbers and copies of what you submitted. An immediate threat, identity misuse, or significant financial loss is also a reason to contact local law enforcement.
What a legitimate rules page usually looks like
A legitimate promotion or gaming rules page normally identifies the sponsor or operator. It lays out eligibility, dates, restrictions, entry steps, and contact information, though the details vary by offer.
Some real promotions use a separate rules-hosting service. The useful question is whether the brand's official site links to that service, not whether the page looks polished.
A rules page shouldn't require your account password or one-time login code just to show its terms. If it requests sensitive information, verify the page before continuing.
Make the check routine
Begin in the official app or at a website address you already trust. Compare the domain and the information request before entering anything.
If either check fails, close the page and save the evidence. Use the official support route, contact your financial institution if needed, and report the page through the channels above.