Field note · 6 min read
The “mystery box” trap: how a $2 Facebook ad becomes a $37-a-month charge you never agreed to
“Unclaimed” parcels and $2 mystery boxes stuffed with premium gadgets are one of the fastest-growing Facebook ad scams — because the real product isn't the box. It's the recurring subscription buried in the fine print, and the card details you hand over to get it.
The ad promises a “mystery box” or an “unclaimed” parcel — supposedly holding hundreds of dollars of Apple, Dyson or Samsung goods — for a token $2 or $3 “shipping fee.” It feels like a harmless flutter. Then, days later, a charge for €40 or $37 hits your card, and another two weeks after that, and support is a dead email address.
That's the trap working exactly as designed. The box was never the point. Security researchers have traced sprawling networks of near-identical “mystery box” storefronts whose real purpose is two things: to enroll you in a recurring subscription through a checkout clause written to be missed, and to harvest the card details you typed in for that tiny “shipping” charge.
This is a “negative option” — you're opted in unless you act — and the way to beat it is to recognize the pattern before you reach for your card.
The cheap box is bait; the subscription is the business
The economics only make sense once you see it. Nobody ships you $500 of electronics for $3 — and they don't. The tiny upfront fee does two jobs: it gets your card number into their system, and it disguises the real charge. Somewhere on the checkout, usually in small or low-contrast text you scroll past, is a line that turns your one-off “purchase” into a membership: a 3-day trial that rolls into roughly €39–€67 a month, or a “store credit” that re-bills every two weeks.
You didn't knowingly agree, but the fine print says you did. That's why these are called subscription traps or “free trial” traps — the free part is real, the ongoing charge is the product, and the design goal is to make the enrollment easy to miss and hard to cancel.
The tells before you pay
An absurd value-to-price gap ($500 of goods for $2) is tell number one — treat it as a certainty that something else is being sold. Tell number two is any mention of a “trial,” “membership,” “store credit,” or a pre-ticked box near the pay button. Tell number three is a checkout that asks for full card details to cover a “free” or near-free item; a genuine giveaway doesn't need your card on file.
Read the text immediately above and below the payment button slowly, and expand any “terms” link. If you have to hunt for how you'd cancel, that's the answer — the difficulty is intentional. Real stores state the price once, clearly, and don't need a recurring authorization to send you a one-time box.
Why it slips past careful people
These operations run thousands of rotating ad variations from disposable pages, each shown briefly to a small audience so complaints never accumulate in one place. The stores look polished, display invented trust badges, and use fake or repurposed reviews. Some even detect your phone model and only show the malicious flow on mobile, where the fine print is hardest to read. None of that is an accident; it's engineered to defeat exactly the skepticism you'd normally apply.
So the defense isn't spotting a “sketchy” site — they don't look sketchy. It's the pattern: token fee, dream prize, card required, fine-print enrollment. When those four line up, it's a trap regardless of how clean the page looks.
If you already paid: move fast
Call your bank or card issuer, report the charge as unauthorized, and ask them to block the merchant and issue a new card number — that's the only reliable way to stop the re-bills, because “cancelling” on the scam's own site usually does nothing. Save the ad, the receipt, and any charges as evidence for the dispute.
Regulators are tightening the screws on this exact tactic — the FTC's rules on negative-option marketing require that recurring charges be disclosed clearly and be as easy to cancel as they were to start — but enforcement is slow and these operators are offshore and disposable. Your card issuer is a faster ally than the store will ever be.
Documented cases
Sources
Saw an ad you're not sure about?
Check it against the archive of documented Facebook-ad scams.
Browse the verdicts →