It sounds like an easy win. Scan your face, spin a virtual wheel, and walk away with a free $250 Amazon gift card. But federal regulators say there is a dark side to these viral smartphone apps, which have exploded in popularity ahead of the 2026 holiday shopping rush.
The Federal Trade Commission announced on Tuesday that it has launched a formal investigation into several mobile applications accused of harvesting users’ biometric data under the guise of promotional giveaways. Millions of consumers have already downloaded these programs, lured by the promise of free holiday cash. Instead, officials warn, users are trading their most personal physical identifiers for rewards that never arrive.
A High-Tech Trap for Holiday Shoppers
The probe focuses on a handful of highly viral apps, including “GiftGrab,” “AmzRewardz,” and “instantWin.” These programs, which spread rapidly through coordinated advertising campaigns on TikTok and Instagram, claim to partner with Amazon to distribute promotional balances. To claim the funds, users are prompted to complete a “human verification” step. This step requires them to stare into their phone cameras, blink, turn their heads, and record short voice clips.
While the apps pitch this as a standard anti-fraud measure, cybersecurity experts say something much more predatory is happening. The apps are allegedly capturing detailed facial geometry, voiceprints, and even fingerprint scans if the user’s phone has biometrics enabled. Once the data is harvested, the app typically crashes, locks the user out, or displays an error message saying the gift cards are temporarily out of stock.
“Your password can be changed if it gets hacked,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “Your face cannot. Biometric data is a permanent identifier, and once these companies steal it, you cannot get it back.”
How the Data is Monetized
Independent security analysts have tracked the destination of this stolen data. According to reports submitted to the FTC, the biometrics are quickly bundled and sold on illicit data broker networks. In some cases, they are used to train artificial intelligence models or to bypass security protocols on financial applications.
The timing of the scam is no coincidence. With the 2026 holiday shopping season just around the corner, millions of households are looking for ways to stretch their budgets. Inflation and rising retail prices have made the promise of free gift cards incredibly appealing, especially to younger demographics who are more likely to trust mobile-first promotions.
The Targets: Teens and Budget-Conscious Shoppers
The FTC’s preliminary findings show that high school and college-aged users are disproportionately affected. Many of these users downloaded the apps after seeing videos from popular social media influencers who were paid to promote them. Some influencers have since deleted their videos and issued public apologies, claiming they were misled by the apps’ developers, who often operate behind shell companies based overseas.
Amazon has denied any connection to these applications. In a public statement, a company spokesperson urged customers to remain vigilant. “Amazon does not use third-party apps to distribute promotional cards via facial recognition,” the spokesperson said. “We are cooperating fully with law enforcement and federal regulators to shut down these unauthorized schemes.”
Regulators Demand Accountability
The FTC has issued civil investigative demands to several app store developers and advertising networks that hosted the fraudulent software. The agency wants to know how these apps bypassed standard security screenings on major platforms like Google Play and the Apple App Store.
Advocacy groups are calling for harsher penalties. They argue that app stores must do a better job of policing their marketplaces before malicious software reaches millions of devices. “The current screening processes are failing consumers,” said Clara Zhang, a digital privacy advocate with the nonprofit group Consumers First. “An app should never be allowed to access a device’s camera for biometric mapping under the pretense of a simple gift card giveaway.”
Protecting Your Digital Identity
As the federal investigation continues, security officials are offering critical advice for consumers looking to protect themselves this holiday season:
- Be skeptical of “free” offers: No legitimate retailer will ask for biometric scans, facial maps, or voice recordings in exchange for a coupon or gift card.
- Check app permissions: Regularly review which apps have access to your phone’s camera, microphone, and contacts. If an app doesn’t need a permission to function, revoke it.
- Look for the developer’s name: Before downloading any app, look at the developer information. Be wary of apps created by unknown entities with generic names and no official website.
- Report suspicious activity: If you believe you have fallen victim to a biometric harvesting scam, file a report immediately at ReportFraud.ftc.gov.
The FTC’s investigation is expected to run through the end of the year. In the meantime, regulators are working to coordinate with international law enforcement agencies to track down the developers behind the scam, many of whom are believed to be operating from servers located outside the United States.
About the Author
