An unexpected message about a sweepstakes account needs a separate check before you act on its instructions. A familiar logo or an account-related subject is not enough to establish who sent it. The Federal Trade Commission advises people to contact a company through a website or number they already know is genuine, rather than using details in a suspicious message. [1]
This explainer applies that consumer guidance to account messages. It does not report a new scam campaign, identify an operator as compromised or confirm that a particular message is fraudulent. The primary guidance was opened on October 22, 2026; its original publication date was not established from the pages available during this check.
Separate the claim from the requested action
Use this original three-part record before opening a link or replying:
- What the message claims: for example, that an existing account needs attention. Record the claim without treating it as confirmed.
- What it asks you to do: open an attachment, follow a link, supply information or relay a login code. These are different requests, even if the message presents them as one routine step.
- How you can check independently: reach the service through the address or app you already use, then ask whether the request exists. Do not use the message itself to establish the contact route.
The FTC describes phishing messages that use apparent account or payment problems to obtain information. A convincing presentation does not settle the question of authenticity. [1]
A fictional message, worked through
Suppose a message says an account issue will be resolved after you send back the next login code. This is a made-up example, not a message received by our team or attributed to an operator.
In the record above, the account issue is an unconfirmed claim. The requested action is handing a code to another person. The independent check is a new contact through a known route, without continuing the original exchange. No account number, password, document or code needs to appear in that initial enquiry.
The FTC explains that a one-time passcode can be a login credential and warns against sharing a verification code with someone who contacted you first. Its guidance also recommends protecting the email account that receives such codes. [2]
Ask about the request without supplying its contents
An original question you can adapt is: “I received an unexpected message asking me to complete an account action. Can you confirm whether there is a request on my account and where your official process starts?” Keep any credential out of the enquiry.
Our identity-verification guide covers document checks. This message check addresses an earlier question: whether the person directing you to a process is authentic. It does not establish which documents a particular operator requires or whether an account is eligible for redemption.
If you believe personal information was exposed, the FTC directs readers to IdentityTheft.gov for steps tailored to the information involved. It also provides phishing-reporting routes in its consumer guidance. [1] A report is not a guarantee of account recovery or reimbursement. Keep the facts you observed separate from conclusions about who was responsible.