3
A request for your bank details “to deposit the winnings”
Plausible, which is what makes it work.
This one is awkward because legitimate promotions do sometimes pay by transfer, and will sometimes need account details to do it.
The difference is sequence and channel. A real promotion asks after you have claimed, through a form on the site you entered on, having already told you who they are. A scam asks first, by email or phone, in a conversation you did not start.
And nobody legitimate needs your online banking password, your card PIN, or a verification code sent to your phone. Those are not payment details. Those are the keys to the account.