The post appeared in your feed with the confidence of a lottery announcement. “CONGRATULATIONS. Comment @highlight to win a trip to the North Pole.” A brand logo. A stock photo of a tropical resort that had nothing to do with the North Pole. And underneath, three thousand comments—each containing exactly the same word.

You looked at it. You thought, “Why not?” You typed @highlight.

You didn’t win anything. But someone just received free advertising—courtesy of your entire network.

What @highlight Actually Does

Let’s dispense with the mystery. @highlight is not a secret code. It’s not a hack. It doesn’t reveal who’s viewing your profile, and it certainly doesn’t enter you into a legitimate contest.

It’s a platform engagement mechanic. When you comment on a post, the algorithm registers activity—and activity is the currency that determines how far a post travels. More comments mean more reach. More reach means more comments. The cycle feeds itself.

So when a post instructs you to “comment @highlight to enter,” what it’s actually saying is: please trigger the algorithm on my behalf, because I’d rather not pay for advertising.

Every comment you leave is a signal to the platform: “This content is interesting. Show it to more people.” You’re not entering a competition. You’re becoming a distribution node in someone else’s marketing campaign.

It’s Usually Not the Brand You Think

Here’s what most people miss.

These posts dress themselves in the logos and language of major brands—Apple, Samsung, Hilton, luxury resorts. But the accounts running them are rarely the brands themselves. Major corporations don’t need Facebook comment mechanics to move products. Their marketing budgets are measured in billions.

The accounts behind these campaigns are typically:

• Local resellers trying to build an audience cheaply
• Unofficial “representatives” or regional importers
• Independent shops trying to shift inventory
• Pages that exist solely to farm engagement and sell the audience later

They borrow the brand’s prestige. They make you pay the marketing costs—with your credibility, your network, and your time.

The Algorithm Cascade You Just Triggered

The technical reality is worth understanding, because it explains why this keeps working despite being transparently fake.

When three thousand people comment on a single post, the platform’s algorithm doesn’t see spam. It sees high-engagement content. The response is predictable: push it to more feeds, show it to friends of commenters, surface it in recommendations.

You didn’t just comment. You triggered an algorithmic cascade. Your comment told the platform to show this post to your connections. Their comments told it to show it to theirs. Within hours, a zero-budget post from a page with 800 followers has reached 200,000 people.

This is the reach that legitimate advertisers pay thousands of euros to achieve. You delivered it for the price of six keystrokes.

The Psychology of Why This Works

This isn’t about intelligence. The people who comment @highlight aren’t foolish—they’re untrained. And the tactics used against them are textbook social engineering:

• Loss aversion: “Limited time! Only 24 hours left!” Your brain prioritises not missing out over evaluating risk.
• Social proof: Three thousand comments suggest three thousand people think this is legitimate. If everyone’s doing it, it must be real.
• Authority bias: A familiar brand logo activates trust before critical thinking has time to engage.
• Low perceived cost: “It’s just a comment. What’s the worst that can happen?” The cost feels trivial because the exploitation is invisible.

These are the same psychological triggers used in phishing campaigns, business email compromise, and social engineering attacks. The medium is different. The mechanics are identical.

The Data You’re Volunteering

When you comment on one of these posts, you’re handing over more than engagement.

Your public comment reveals your name, your profile, your location (if listed), your employment (if listed), and your network connections. The page operator now has a list of thousands of people who have publicly demonstrated one critical trait: they respond to incentive-based calls to action without verification.

That list has value. In the GDPR era, where direct tracking and cross-site targeting face increasing restrictions, engagement-farmed audiences are a loophole. You “voluntarily” engaged. Nobody scraped your data—you handed it over. And in some cases, these pages get sold, complete with their audience. Yesterday’s giveaway page becomes tomorrow’s dropshipping store, crypto scheme, or phishing staging ground.

The Part Nobody Mentions: The Phishing Pipeline

This is where it gets genuinely dangerous.

Engagement farming is often stage one of a longer operation. The page builds an audience through fake giveaways. Once the audience is large enough, the content shifts:

• “Claim your prize—click this link and enter your details”
• “Congratulations! DM us your email and phone number to receive your gift”
• “Verify your identity to complete your entry”

Each step escalates. Each step feels reasonable because you already invested in the initial engagement. And each step brings you closer to credential theft, identity fraud, or financial loss.

The page that asked you to type @highlight today might be sending you a malicious link next month. And you’ll click it—because you already trust the source.

The 15-Second Checklist

Before you engage with any “giveaway” post, ask:

• Are there published terms and conditions? Legitimate contests are legally required to disclose rules, eligibility, and winner selection methods.
• Is the organiser clearly identified? A real company puts its legal name on its promotions. A farming page hides behind brand imagery it doesn’t own.
• Does it demand you comment, tag, or share to “enter”? That’s not a contest mechanic. That’s an amplification request.
• Do the comments look human? Scroll down. If it’s three thousand identical comments, you’re looking at a bot cemetery—or the human equivalent.
• Is the page verified? Check the blue tick. Check the page history. Check when it was created.

If the “contest” relies on you amplifying it, it’s not generosity. It’s extraction.

What You Should Actually Do

Nothing. That’s the answer.

Don’t type the keyword. Don’t tag your friends into bait. Don’t reward pages that substitute manipulation for transparent marketing.

And if you see someone you know falling for it—tell them. Privately. Without condescension. Because the only reason this keeps working isn’t that the scammers are clever. It’s that not enough people have been shown how the mechanics actually operate.

The next time a post promises you something for free in exchange for a comment, remember: you’re not the contestant. You’re the prize.

Want to strengthen your team’s ability to recognise social engineering tactics—online and in the inbox? Let’s talk about security awareness.