Rewards Site Scams: 9 Checks Before You Sign Up

The rewards category is full of real businesses and full of scams, and from a search results page they look identical. These nine checks take about two minutes and rule out almost everything harmful. Run them on any site — including this one.

1. Does it claim to "generate" codes?

This is the clearest signal there is. Every free code generator is a scam, without exception, for every platform:

• Steam wallet codes, PSN vouchers, Xbox and Microsoft codes
• Google Play and Apple gift cards
• Robux, V-Bucks and other in-game currency
• Amazon, Visa and retailer cards

The reason is structural, not moral. These codes are issued once, by the platform, from a controlled inventory, and each one is single-use and tracked. There is no algorithm that produces valid ones, and no site sitting on a public list of working codes it is giving away. Valve, Sony, Microsoft and Google would all notice.

What generator sites are actually doing is one of three things: phishing your platform login, delivering malware through the "generator" download, or farming you through an endless survey for affiliate revenue.

2. Does it ask you to "verify you are human" forever?

The human verification loop is the signature move. You click the code, and to unlock it you must complete "two quick offers" — then two more, then a phone number, then a subscription. There was never a code.

A legitimate site tells you the price of a reward in its own currency before you sign up, and the price does not change as you approach it.

3. Does it ever ask for a platform password?

No legitimate rewards site needs your Steam, PSN, Xbox, Epic or Roblox password. Not to deliver a card, not to verify ownership, not to "link" your account. A gift card is a code that you redeem yourself, inside the platform.

The same applies to a Discord DM offering a free card, a "friend" who needs you to log in through their link, or anyone asking you to read out a code you already hold. The FTC is blunt about the last one: only scammers tell you to pay with a gift card and read out the numbers. Valve keeps its own page on Steam gift card scams.

4. Does it want money to give you money?

Any fee, deposit, "verification payment", "account upgrade" or crypto transfer required before a withdrawal is a scam, one hundred percent of the time. Real rewards sites are funded by advertisers, so revenue flows toward you and never from you.

A cost that is not money still counts: an offer requiring you to buy something should pay enough to clearly beat what you spend, and you should treat one that does not as a bad deal rather than a bargain.

5. Is the payout threshold fixed and reachable?

Check the reward prices before you earn a single point, and check that they are stated in the same units you earn in. Warning signs:

• Thresholds that rise as your balance does.
• Rewards permanently "out of stock" at every tier you can afford.
• A minimum payout so large that no realistic amount of activity reaches it.
• Prices shown only after registration.

For reference, XPReward publishes its prices openly: 144 points per $1 of face value, cheapest claimable reward 3,600 points ($25), with 250 welcome points at signup. That is a high floor and we say so in how much you can actually make — but it is fixed, it is public, and it does not move.

6. Are the earnings claims plausible?

Realistic is $2 to $5 an hour for survey-led earning and somewhat better for offers. A site implying a wage, a guaranteed monthly income, or a $50 card for ten minutes of clicking is either lying or about to ask you for something.

And be sceptical of a payout threshold that is only reachable by doing the thing the site most wants you to do, like recruiting people.

7. Do the reviews hold up to a second look?

A public review page is useful, but read it properly rather than glancing at the score.

• Check whether the score is even being displayed. Review platforms suppress ratings when a company breaches their guidelines. Torox is a live example — its Trustpilot score is suppressed and Trustpilot states it removed fake reviews — which is why our Torox guide treats both halves of that review page with caution.
• Read the one-star reviews for specifics. "Scam!!!" tells you nothing. "Offer 4412 pending 40 days, ticket #8817 unanswered" tells you a lot.
• Distrust a wall of identical five-star reviews posted in a short window.
• Expect a polarised split. Offerwall-based sites always have one, because only the unhappy half writes in. It is not by itself a red flag.

Our reviews of CPX Research, AdGate and Lootably are written to this standard, including the complaints.

8. Does it have real terms, privacy and a human?

A site handling your data and owing you value should have a genuine privacy policy, terms and a working contact route. Their absence is not a formality problem — it means there is no stated rule about what happens to your balance, your data, or a dispute.

A public about page naming what the business actually is helps too.

9. Can you see your own history?

The test almost nobody applies, and the most revealing one: can you see every point you earned and spent, and when?

If your balance is a single number that can change without explanation, you have no way to detect an error, let alone contest one. If there is a transaction history, you can check the site against itself.

On XPReward every earn event is recorded in an append-only ledger with an explicit state — pending, credited, held or reversed — visible in your Wallet. A held completion is recorded rather than dropped, and reversals appear as their own entries instead of a silent adjustment. What those states mean is documented rather than internal.

If you already got caught

Act in this order:

1. Change the password on the platform account you entered, from a device you trust.
2. Turn on two-factor authentication, or Steam Guard, or the platform equivalent.
3. Revoke active sessions and deauthorise unknown devices in the account's security settings.
4. Check for changes you did not make: a new recovery email, a new phone number, altered payment details.
5. Contact the platform's official support — Valve, Sony or Microsoft — through the platform itself, never through a link you were sent.
6. Run a malware scan if you downloaded a "generator".
7. If you gave out a code, report it to the issuer immediately. Speed is the only thing that helps.
8. If you paid a fee, contact your bank or card issuer about a chargeback.

The two-minute version

• No generators. Ever.
• Nobody needs your platform password.
• Nothing legitimate charges you to withdraw.
• Prices are public and fixed before you start.
• Earnings claims are modest.
• Reviews are specific, and the score is actually displayed.
• Terms, privacy and a contact route exist.
• You can see your own transaction history.
• If you are being rushed, it is a scam.

If you want to see a site that passes its own checklist, create a free XPReward account — the Reward Store prices are visible before you earn anything, and how XPReward handles trust is written down.