Bitdefender Labs warn of Independence Day scams ahead of July 4

As millions of Americans prepare to celebrate Independence Day, cybercriminals are launching scams designed to take advantage of holiday excitement, patriotic pride, and limited-time offers. Researchers have identified multiple campaigns spreading through text messages, WhatsApp, Telegram, email, and social media—all using July 4th as the hook.

Key takeaways

•  Bitdefender Labs is tracking multiple active Fourth of July-themed scam campaigns targeting Americans across SMS, WhatsApp, Telegram, and email.
• Researcher Alecsandru Daj observed coordinated operations exploiting patriotic messaging, holiday shopping, and America's upcoming 250th anniversary to increase victim engagement.
• Fake giveaways impersonate trusted brands like Costco, Publix and Tim Hortons.
• Investment scams on Telegram promote fake commemorative gold coins.
• Smishing campaigns use patriotic themes to steal personal information and money.

1. Fake ‘250th Anniversary Gold Coin’ Investments

According to Bitdefender researcher Alecsandru Daj, one of the most sophisticated campaigns we’ve been tracking targets Telegram users with offers to purchase "Official 250th Anniversary Gold Coins."

Messages urge recipients to act before July 4, claiming supplies are running low. They encourage buyers to buy dozens or even hundreds of coins as an investment for future generations. Victims are promised extraordinary returns, with coins allegedly worth nearly $2 million despite costing only around $163.

The scammers continually refine their messages using different emotional approaches, including:

• Protecting your grandchildren's future
• Fear of missing history
• Exclusive patriot status
• Time-limited availability

Here are some recent examples of fraudulent Telegram messages:

Sample 1

ONE QUESTION BEFORE YOU SCROLL PAST THIS:

What are you going to tell your grandchildren when they ask — "Where were you when America turned 250?"

The patriots who acted today will say: "I secured these coins for you. I was there. This is yours forever."

30 coins. 50 coins. 100 coins. Your $163 price is still active.
Your grandchildren are still waiting.

[fraudulent link]

Official 250th Anniversary Gold Coin — Three Generations. One Legacy. Chosen Patriots Only.

Sample 2

VAULT BREACH STILL ACTIVE —

Diamond Patriots secured 100 coins. Elite Patriots secured 50 coins. Active Patriots secured 30 coins.
Their patriot status is CONFIRMED. Their families are protected.

Your vault is STILL being drained. Your grandchildren STILL have nothing.

One click. That is all.

REAL PATRIOTS DON'T SCROLL PAST THIS.
[fraudulent link]

These are classic investment fraud tactics. If an offer sounds too good to be true, it almost certainly is.

2. ‘Free Independence Day Gifts’ on WhatsApp

Another campaign impersonates major retailers including Publix, Costco, and Tim Hortons.

Users receive WhatsApp messages advertising free Independence Day gifts, often appearing to come from friends or family members rather than unknown numbers. According to researchers, around 90% of these messages originate from contacts already saved in the recipient's phone, making them far more convincing.

Clicking the links leads to phishing websites designed to steal:

• login credentials
• personal information
• contact details
• potentially payment information

If someone you know suddenly sends an unexpected holiday giveaway, contact them through another form of communication before opening any links. Be especially wary of domains ending in .top, as these are a strong indicator of a scam.

If you’re unsure if a brand is handing out freebies ahead of 4^th of July weekend, visit the official company website to verify before engaging with this type of giveaway links, even if they come from a known contact.

We’ve seen multiple campaigns on WhatsApp that follow this pattern. Last year, users were targeted with fake Sephora advent calendar giveaways where recipients were asked to forward the link to all WhatsApp contacts if they wanted to claim the prize, making them active promoters of the scam.

Note: The food and retail brands listed above are legitimate businesses whose identities have been misused by cybercriminals. These organizations are victims of brand impersonation, not sources of the security issue. Bitdefender has no evidence that any of these brands were directly compromised or involved in the fraudulent activity.

4. Fake Fourth of July Sales

Holiday shopping provides another opportunity for scammers.

Fraudulent SMS campaigns impersonate well-known brands with "Fourth of July Flash Sale" promotions offering huge discounts on popular products. These Smishing campaigns began on July 1, targeting users across California, Florida, Georgia, Alabama, and Texas.

These messages often include:

• Professional-looking formatting
• Unsubscribe instructions
• Realistic sale deadlines
• Convincing branding

Behind the scenes, however, the links lead to fake shopping websites intended to steal payment card information or other sensitive data.

Whenever you receive a shopping offer by text, visit the retailer's official website directly instead of using the provided link.

5. Patriotic Email Offers That Create False Urgency

Email inboxes are also filling up with patriotic promotions advertising exclusive collectibles and limited-edition merchandise, including Trump Eagle Coin 2025 , Trump Treasure Box 47th President Edition,  Never Surrender Gold Sneakers, Fight Fight Fight Watch,  Trump D.O.G.E. Coin

Many use phrases like:

• "Only a few left"
• "Offer ends tonight"
• "Last chance"
• "Patriots move fast"

These messages are designed to pressure recipients into making impulsive purchases. Shoppers usually receive fake products or nothing at all, while exposing their personal and financial information.

How to stay safe this Fourth of July

A few simple habits can dramatically reduce your risk of falling for this type of holiday-themed scams:

Be skeptical of investment opportunities promoted through messaging apps

No legitimate investment opportunity will pressure you to act before a holiday deadline or promise extraordinary returns. If someone encourages you to buy commemorative coins, cryptocurrency, or other assets through Telegram, WhatsApp, or social media, treat it as a red flag. Always research independently and verify offers through official sources before sending money.

Protect your mobile device, where many of these scams begin

This year's campaigns are heavily centered on smartphones, arriving via SMS, WhatsApp, Telegram, and mobile-friendly phishing pages. Because your phone is often the gateway to your banking apps, email, passwords, and digital identity, protecting it is just as important as securing your computer.

Using a trusted mobile security solution for Android and iOS, keeping your operating system and apps up to date, and enabling anti-phishing protection can help block malicious links and detect threats before they reach you.

Verify links before clicking

Scammers frequently disguise malicious websites behind shortened URLs or domains that mimic trusted brands. If you're unsure whether a link is legitimate, check it first with Bitdefender Link Checker before opening it for free.

Think before you trust unexpected messages

A message from a friend or family member isn't always what it seems. If you receive an unexpected giveaway, investment opportunity, or urgent request, verify it through another communication channel before clicking links or sharing personal information.

Have a chat with Bitdefender’s free AI-powered scam detector to identify scam messages

If you're unsure whether a text message, email, QR code, or social media post is legitimate, Bitdefender Scamio can analyze suspicious content and help you determine whether you're dealing with a scam.

Monitor your digital footprint

Some campaigns may use your real name, ZIP codes, or other personal details to appear more convincing. Bitdefender Digital Identity Protection helps you discover whether your personal information has been exposed in data breaches, allowing you to take action before criminals can misuse it.

Disclaimer: This article is published for informational and educational purposes only. The information presented is based on technical research conducted by Bitdefender Labs and publicly available sources. Bitdefender does not make any legal determination regarding the activities described herein. The mention of any company, brand, domain, or individual does not constitute an accusation of illegal activity. The technical indicators and behavioral patterns described reflect observations made at the time of research and may change over time. Readers should exercise their own judgment and consult appropriate authorities or legal counsel if they believe they have been affected by any of the activities described. Domain names and URLs listed in this article are provided solely to help consumers and security professionals identify potentially harmful infrastructure. Bitdefender disclaims any liability for actions taken based on the information in this article.