Texts and calls

The Costco Receipt Survey Text Scam, October 2026

Updated 22 October 2026

You bought a rotisserie chicken and a pack of paper towels three days ago. So when a text says Costco wants your opinion on that visit, and is offering ninety dollars for thirty seconds of your time, your brain fills in the rest. The chicken was real. The receipt was real. The text is the lie, and the link inside it is the part that costs you.

The Tell: A Survey URL That Has Nothing to Do With Costco

The text lands in a blue bubble, sometimes with a Costco logo lifted off a press kit, sometimes plain. It thanks you for shopping on a specific date. It names a real store location, often the one nearest the cell tower your phone just pinged, which is the part that makes the read feel grounded. Then it offers a reward. In the wave showing up on US numbers this week, the reward is ninety dollars in the form of a digital gift card, redeemable after you complete a short survey. The link is a shortened URL, usually a fresh one generated for the campaign, that redirects two or three times before it parks you on a page dressed up to look like Costco's customer feedback portal.

Costco does run a receipt survey, and the real address is at costco.com. It is not a text program. Costco does not pay customers to take it. The receipt you actually got at the till is a piece of paper. The company does not pair it with a follow up SMS. Any text that says it does is impersonation, and impersonation is the entire product.

There are three signals in the link itself, and you can read them before you tap. The domain is not costco.com. It might end in a country code you have never seen, or in a string of letters that look like a coupon code, or in a top level domain like .top, .click, or .cyou that legitimate retailers do not use for storefronts. The path after the slash often includes a long string of random characters, which is how the scammers track which text you came in on. And if you hold the link down on a phone, the preview that pops up usually shows a different brand name entirely, the next redirect in the chain.

The survey itself, once you load the page, is built to harvest. It will ask the name on your card, the card number, the expiry, the CVV, and the billing ZIP. Some versions ask for a one time code your bank then texts you, which is the bank trying to verify a transaction the scam page is pushing through in real time. By the time the survey ends, the card has been cloned, the code has been spent, and the ninety dollar gift card never resolves. The page sits on a thank you screen, sometimes for hours, while the operator moves the balance out through a string of smaller purchases that look less like fraud to the bank's filters.

The Law: Impersonation, Wire Fraud, and the State AG

Impersonating a brand in a text to obtain money or financial data is a federal offence under 18 U.S.C. 1343, wire fraud, and under 18 U.S.C. 1028, fraud in connection with identification documents or credentials. A card skimming page that asks for the CVV, the three digit code on the back, also triggers 18 U.S.C. 1028(a)(7), the federal aggravated identity theft statute, because the CVV is treated as a credential that uniquely authorises a transaction.

The Telephone Consumer Protection Act does not give you a private right of action against this kind of scam, but it does give the carriers the obligation to filter the messages in the first place. The real regulatory muscle sits with the Federal Trade Commission under the FTC Act's prohibition on unfair or deceptive practices, and with the Consumer Financial Protection Bureau, which has parallel authority when a payment instrument is involved. The FCC's TCPA rules, updated in 2024 to require prior express written consent for marketing texts, are what the carriers cite when they explain why they are slow rolling the next wave of these campaigns.

On the state side, the attorney general in most US states can bring a case directly, and the state consumer protection division will take a complaint that feeds an active investigation. The handful of states with specific anti phishing statutes, including Georgia, Virginia, and Ohio, can also pursue the operators through their criminal code. The 2023 increase in state level fines for deceptive texts, passed in California, New York, and Washington, has not stopped the campaigns, but it has shortened their life cycle. A text blast that would have run for a fortnight in 2024 now gets burned through in two or three days, because the carriers and the brand protection teams learn the URL pattern fast.

For you, the law matters less as a sword and more as a route to a refund. The Fair Credit Billing Act caps your liability for unauthorised card charges at fifty dollars, and most issuers waive that entirely if you report the loss within two business days. The Electronic Fund Transfer Act gives you sixty days to dispute an unauthorised debit, and zero liability if you report within two days of learning of the loss. If the survey page pushed through a debit card transaction rather than a credit, that two day clock is the one that matters.

The Recovery: What To Do In The First Hour

The first minute is the only minute that counts, because the scam page is built to spend the card while you read the survey. If you tapped the link but did not type anything, the risk is mostly the cookie and the redirect chain, not the card. Clear the browser, run a scan, and move on. If you typed the card number, the expiry, the CVV, or the one time code the bank texted you, the card is already in the hands of a carding operation, and the only move is to make the card useless before they finish a card test on it.

Call the issuer on the number on the back of the card, not the number in the text. Tell the fraud team that the card details were entered into a phishing page. Ask them to block the card and reissue with new numbers. Ask them to flag the pending transactions from the survey page, which the issuer can usually pull back if they are still in the authorisation queue. Ask them to add a note to the file that a CVV was captured, because that is the trigger for the bank's internal fraud rules and it speeds up the dispute if the operator moves the balance out overnight.

If the page also asked for a one time code, change the password on the bank account itself and rotate any password you have reused on shopping sites. The code is the second factor on a transaction the page is already pushing through, which means the operator is not guessing your password. They are using the code you just gave them. The password rotation is for the next site the operator tries with the same email and password pair, because the survey page also runs a credential stuffing check in the background, matching the email you typed against known breach dumps.

Forward the original text to 7726, which is SPAM on a phone keypad, and the carrier will log the sender and start the takedown. File a report with the FTC at reportfraud.ftc.gov, and with the FBI's Internet Crime Complaint Center at ic3.gov, because IC3 is the place the FBI cross references phishing patterns across state lines. If the survey named a specific Costco store, forward the text to the real Costco customer service line at 1-800-774-2678, because the brand protection team will want the URL for the takedown request, and Costco is one of the brands that does move fast once they get the link.

Then freeze your credit at the three bureaus, Equifax, Experian, and TransUnion, which is free and reversible. The survey page did not ask for a Social Security number, so the freeze is defensive, not corrective. The reason to do it anyway is that the email and password you typed are now in a list, and the next campaign will be a credit card application, not a gift card. The freeze makes that application fail at the bureau check, before a new account gets opened in your name.

Why A Ninety Dollar Bait Works

The dollar figure is a piece of engineering. Too low, and the read does not survive the mental arithmetic of a real Costco trip. Too high, and it trips the filter that the reader is being offered something for nothing. Ninety dollars sits in the range where the brain agrees to play, because it is a number that could plausibly be a marketing budget, a refund, or a goodwill gesture. The chicken cost six dollars. Ninety dollars is fifteen chickens. The asymmetry is the point.

The text is also short, which is a deliberate trade off. A long text gives the reader time to read the URL, the date, and the offer as separate claims, and each claim is a place the brain can object. A short text treats the URL as decoration, which is what the operator wants. The ninety dollars is the headline. The link is the door. The page is the trap.

Costco is the right brand for the bait because the company is ubiquitous, the receipt is a familiar object, and the actual customer service channel is wide. Costco has 130 million cardholders worldwide, and most of them have a receipt in their pocket from the last week. The text does not need to be accurate about the visit. It needs to be plausible, and a real visit you actually made is the most plausible bait of all. The carding operation does not know what you bought, but it does not need to. The brain will fill in the chicken.

Frequently Asked

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.