The Fake Prize or Lucky-Draw Winner Notice
The lucky-draw scam is one of the oldest and most persistent lures in Indonesia, dressing up as a bank, telecom, or brand promotion to extract fees or one-time passwords. This walkthrough is a fictional, illustrative example built for training.
The scenario
A message arrives by SMS, WhatsApp, or email announcing that the recipient has won a major prize, such as cash, a motorcycle, or a car, in a lucky draw (undian) supposedly run by a well-known bank, mobile operator, or retail brand. A prize code and a hotline number are included.
When the victim contacts the number or replies, an 'officer' congratulates them and explains that to release the prize, they must first pay a redemption fee, tax, or shipping cost, or transfer a deposit that will 'be refunded' once the prize is delivered.
In another variant, the victim is told a verification code has been sent to their phone and is asked to read it back to 'confirm they are the real winner'. That code is actually an OTP for the victim's bank or e-wallet, and reading it out authorizes a transaction or account change.
Whether through the upfront fee or the shared OTP, the money flows to the attacker. The promised prize is never delivered, and follow-up requests for further 'fees' often continue until the victim stops responding.
Red flags to spot
You won a prize in a draw you never entered
Legitimate promotions require you to have opted in. Being told you won something you never signed up for is a hallmark of the scam.
You must pay a fee, tax, or deposit to claim the prize
Real prizes never require the winner to pay money upfront. Any request for redemption fees, taxes, or deposits is fraud.
You are asked to read back a code sent to your phone
That code is an OTP protecting your own account. Sharing it does not confirm a prize; it authorizes the attacker to move your money or take over your account.
Contact runs through a personal number or account
Genuine brand promotions are handled through official channels, not a personal WhatsApp number or transfers to an individual's bank account.
High-value prize with urgent claim deadline
An extravagant reward plus time pressure is engineered to override your caution and rush you into paying or sharing a code.
The lesson
If you did not enter a draw, you did not win it. No legitimate prize ever requires you to pay a fee, tax, or deposit to claim it, and no one ever needs a one-time password from your phone to give you something; an OTP only ever authorizes an action on your own account. Do not call the number in the message or share any code. Verify any promotion directly through the brand's official website or verified customer service, and report the message so others are not caught by the same lure.
These are illustrative examples built for training purposes only, not real messages sent by Claro or any actual organization.
Frequently asked questions
Real promotions require you to have opted in, are announced through official channels, and never ask winners to pay a fee or share an OTP. If any of those are missing, treat it as a scam.
Related pages
IT Password Reset
A fake IT alert warns that your password or account is about to expire, pushing you to click a login link in a hurry.
Learn moreFake Invoice
An email disguised as an unpaid invoice pressures the recipient to pay quickly to avoid a late fee or service suspension.
Learn moreCourier Delivery Scam
A message claiming to be from a courier says a package couldn't be delivered and asks for a redelivery or customs fee via a link.
Learn moreRun these patterns as real simulations
Claro turns each of these lures into a localized, trackable phishing simulation your team can learn from safely.
Request a demo