Gift Card Fraud: Why Criminals Love Prepaid Value
Gift cards occupy a strange corner of the payment system: they move real money with almost none of the protections money normally travels with. No cardholder identity, no issuer fraud models watching every swipe, no chargeback rights for the person holding the value, and instant global resale markets. That combination makes gift card fraud two businesses in one: criminals attack gift cards to steal their value, and they use gift cards as the getaway vehicle for value stolen elsewhere. Merchants who sell, redeem, or accept gift cards sit in the middle of both.
Quick answer: Gift card fraud takes two main forms. Attacks on cards include balance enumeration by bots, physical tampering with racked cards, and account takeover of saved balances. Gift cards as a cash-out channel include scam victims buying cards under coercion, stolen credit cards converted into gift cards, and laundering through resale markets. Defenses combine packaging and activation controls, bot and velocity defenses on balance checks and redemptions, purchase limits, and trained staff who can interrupt scams at the register.
Why are gift cards such attractive targets?
- They are bearer instruments: whoever holds the code owns the value, with no name attached and no PIN tied to a person.
- They are irreversible in practice: once drained, there is no dispute mechanism comparable to card chargebacks, and recovery depends on issuer goodwill.
- They are liquid: resale marketplaces convert a card number into cash at a predictable discount within minutes.
- They sit outside the heavy fraud infrastructure built for card payments, so attackers meet weaker defenses than the ones described in our fraud model coverage.
How are the cards themselves attacked?
Rack tampering
Criminals take unactivated cards from store displays, record the numbers, scratch and replace PIN coverings or re-wrap packaging, and return them to the rack. When a customer later buys and loads the card, the criminal’s monitoring drains it first. Variants include swapping barcodes so the purchase activates a card the criminal already holds. Countermeasures are physical and procedural: tamper-evident packaging that hides the full number, keeping high-value cards behind the counter, checking packaging integrity at activation, and auditing racks the way our terminal inspection guidance treats payment hardware: assume someone has touched it.
Balance enumeration
Online balance-check pages are the gift card world’s unlocked side door. Card numbers follow predictable ranges, and bots hammer balance endpoints testing millions of combinations to find live, funded cards, then drain or resell them. This is the same automation economics as the card testing attacks we covered for payment cards, and the same defenses apply: rate limiting per IP and per card range, bot detection, CAPTCHA at suspicious velocity, requiring the PIN or a second factor for balance checks, and alerting on enumeration patterns.
Account takeover of stored balances
Where gift balances live inside customer accounts (retail apps, loyalty wallets), credential stuffing converts leaked passwords into spendable balances. Everything in our account takeover guide applies, with one sharpener: balance-bearing accounts deserve step-up authentication on login from new devices and on redemption, because the account is the money.
How are gift cards used to launder other fraud?
Scam payments
Tax-authority impersonators, tech-support scammers, and romance fraudsters overwhelmingly demand payment in gift cards because the transfer is irreversible and anonymous. The victim buys cards at a legitimate store and reads the codes to the criminal. This is the gift card edition of the coercion patterns in our authorized push payment analysis, and the most effective interruption point is the register: purchase limits on card quantity and value, point-of-sale prompts, and cashiers trained to ask one humane question when someone elderly is buying thousands in gaming cards while on the phone. Several retailers’ staff interventions stop more losses than any system.
Carding cash-out
Stolen credit cards buy gift cards; gift cards buy goods or sell for cash. The purchase converts reversible card fraud into irreversible prepaid value before the cardholder disputes. For merchants, gift card SKUs therefore deserve the strictest checkout risk rules: lower velocity ceilings, stronger authentication, conservative treatment of mismatched AVS and CVV signals, and delayed digital delivery on risk flags. Digital gift cards amplify everything: instant delivery means instant loss, so risk scoring must run before the email sends.
Internal leakage
Staff with activation privileges can activate cards without payment, refund purchases onto cards they control, or skim codes during handling: patterns that belong to the insider playbook we examine later this month. Dual control on bulk activation, reconciliation of activations against tenders, and analytics on per-employee gift card activity close most of it.
What does a defense program look like?
- Physical: tamper-evident stock, concealed numbers, controlled racks, activation-time package checks.
- Issuance: purchase limits per transaction and per day, risk-scored online sales, delayed delivery for flagged digital cards.
- Servicing: hardened balance endpoints with bot defense and velocity caps; PIN required for balance and redemption; monitoring for enumeration.
- Redemption: velocity rules on drains, step-up for account-held balances, flags on freshly loaded cards spent remotely at speed.
- People: register prompts and training for scam interruption; dual control and analytics for staff-side abuse.
- Response: a documented freeze-and-trace procedure with your gift card processor, because minutes matter once a victim calls.
Frequently asked questions
Can gift card fraud be charged back like credit card fraud?
No. The gift card holder has no chargeback right; the value is bearer value. When stolen credit cards buy gift cards, the credit cardholder charges back the purchase, leaving the merchant holding both the loss and the drained card.
Why do scammers always demand gift cards?
Irreversibility, anonymity, and liquidity: codes transfer by voice, cannot be clawed back, and resell instantly. Any demand for payment by gift card is a reliable scam signal worth teaching to staff and customers alike.
Are digital gift cards safer than physical ones?
They eliminate rack tampering but concentrate risk in checkout fraud and account takeover, and their instant delivery removes the recovery window. Different, not safer; risk-score them harder.
What should I do if I bought a tampered card?
Contact the retailer and issuer immediately with receipt and packaging; fast reports sometimes catch value before it drains. Recovery is discretionary, which is exactly why prevention is weighted so heavily.
Do velocity limits really matter for balance checks?
Yes, disproportionately: enumeration needs volume, and a strict per-source limit with bot detection converts a profitable scanning operation into an uneconomic one overnight. Measure attempts the way our fraud KPI guide measures everything: attackers respond to economics.
Gift cards are small anonymous bank accounts sold off a rack, and the fraud follows directly from that sentence. Guard the rack, throttle the robots, limit the registers, and teach one question to every cashier: the four cheapest controls in payments, defending one of its softest targets.