Scam campaign analysis: Fake Beauty Box giveaway
Take action: Never trust sponsored posts or social media promotions offering "secret deals" - if a store has a real promotion, they'd advertise it directly on their official website and stores. Don't give your credit card details to any site you reached through social media links, especially if the offer seems too good to be true.
Learn More
A scam distributed via Facebook sponsored posts is targeting customers of the German drugstore chain "dm" to steal financial information and funds by subscribing victims to vague online services.
The campaign is significant for use of AI constructed image of bill from "dm" that's used as overlay on photos of a box of cosmetics to add credibility to the claim. We will analyze the image below.
Massive thanks to the team on the BeyondMachines Discord for a detailed analysis of the website and tracing of APIs and keys.
The scam starts as a story on Facebook claiming to be about someone's mother who worked for "dm" and was fired, but as an employee she found out about a secret beauty box giveaway for a very small amount of money. The campaign is targeted with sponsored ads to female users of Facebook, enticing them to give out their credit card information. The profile that made the post is obviously fake.
Before we analyze the rest of the scam, let's review the "bill image" above. Here's why it's fake:
- The print is too perfect - bear in mind that all store bills are printed on thermal paper, which never produces print quality as a laser printer
- The format of the bill is wrong - Macedonian store bills have a very specific format with QR code at the bottom, which is missing here. We have included a photo of a real bill from "dm market" for comparison.
- The bill looks like it's just printed - a slip of paper has a lot of creases just from being in a wallet. The image is perfect, no creases, no blemishes of transport. Since the "beauty box" was supposed to arrive several days later, how is it possible to keep a perfect bill so long?
- The fingers holding the bill are from an alien, as if from the Wars of the Worlds by H. G. Wells. Put your hand in approximately the same position of holding a piece of paper and measure the distance from the tip of your thumb to the tip of your ring finger. The distance is about three lengths of your thumb nail. But in the scam photo, it's over 4 lengths of the thumb nail.
- There is no store bill if you need to order online - the scam is trying to get you to an online site to enter card details. If that is the real way to get the beauty box, how did the person buy the same box in a store?
The scam bait is in the first comment. It leads to a site which puts the target through a series of "questions" and some sort of a game to create a feeling of investment and effort in the victim - they did some work, so they won't abandon the process when the system asks for money.
The domain promomarkets.store was registered on July 21, 2025 - only 9 days old at the time of this analysis. If this "secret" was long standing, why is this site new?
Finally, the victim is redirected towards a payment site. The payment site which accepts the cards has a lot of legal vague statements, which mentions lotteries and subscriptions. This very probably means that the victim's card will be charged multiple times as part of a subscription that they have "agreed to" (see below)
How to stay safe?
- Don't rush! - nothing is urgent. Consult with multiple people on the suspicious message
- Don't trust anything on social media, especially if it's "promoted". Ask yourself why does this thing need to be promoted to me?
- Photos can be created and manipulated. Never trust a photo, review it in detail and check on other sources and compare to old photos (generated before the year 2020).
- If it's too good to be true, it's false.
Photos of the subscription site.
