12
Anything at all, if you have not checked the promotion exists
The one habit that makes the other eleven unnecessary.
Every item on this list is a shortcut. Here is the thing that works without shortcuts.
Do not reply, do not click, do not call the number in the message. Go independently to the promotion, the site you entered on, found the way you normally find it, and log in. A real win appears in your account. A real promotion has Official Rules with a sponsor name and a postal address. A real winner list can be requested.
If none of that exists, the notification is the only evidence the prize was ever real, and a notification is a document anybody can write.
A real prize survives being checked. That is the whole test, and it is the only one you actually need.
None of this requires you to be cynical about winning things. People do win, promotions do pay, and treating every notification as hostile costs you the occasional genuine prize.
It just requires the order of operations to be right: verify first, celebrate second. The prize will still be there in an hour.