Reward
In plain terms
You are given good news: a refund, a prize, an offer. Good news doesn't trigger suspicion — which is exactly what makes it useful to the attacker.
Definition
Reward is the announcement of a gain — money owed, a prize, a benefit, an opportunity — that requires an action from the victim to obtain.
Why it works
We have learned to be wary of threats, much less of gifts. A pleasant announcement sets off no alarm: we try to obtain rather than to check, and attention goes to the steps to take. The prospect of a gain also makes acceptable what would otherwise be absurd — giving a full card number in order to receive money, for example, an inconsistency that good humor lets through.
What resists it
Apply the same check to a gain as to a threat, and remember a rule that settles almost every case: receiving money never requires paying any first, nor providing anything other than your bank account details (IBAN). A real refund appears in your official account, where you can go and see it.
The question to ask yourself
“Why does this process need something from me if I'm the one receiving?”
The 20 attacks that exploit it
- Premium-rate subscriptions and SMS
- "Sign in with" permission abuse
- Malicious app
- Investment scam
- Baiting
- Trojan Horse
- Malicious browser extension
- Fake AI app
- Fake online store
- Fake prize, fake lottery
- Evil Twin Wi-Fi Hotspot
- AI-generated fake profile
- Fake refund
- Fake download
- Infostealer (credential-stealing malware)
- Fake job offer
- Excessive permissions
- Malicious Captive Portal
- Malvertising
- Resale of personal data
Other levers · Last updated: 2026-09-02.