Ron Cresswell, J.D., CFE
Research Specialist, Association of Certified Fraud Examiners
According to the 2018
Deloitte Holiday Retail Survey, 54% of Americans plan to buy gift cards during the holiday season. Gift cards are the most popular gift listed in the survey, beating clothing (53%), toys and games (46%), and books (43%). Clearly, Americans love gift
cards; unfortunately, fraudsters love them too.
Fraudsters favor gift cards because they are easy to cash in and virtually untraceable. They generally do not contain any personal information linking them to the legitimate purchaser or recipient. Therefore, anyone who has the card number can use the
gift card or sell it for cash. Fraudsters can sell gift cards on websites like eBay or Craigslist. There are also many online gift card resellers that pay cash for gift cards and sell them at a discount.
Stealing gift card numbers
In a common type of gift card scheme, a fraudster steals the identifying information from a gift card, waits for the card to be activated and then uses or sells the card. Consider the following example:
A fraudster takes a $100 gift card from a display rack at a grocery store. Pocketing the card, he walks to an empty aisle, where he uses a razor blade to carefully remove the card from its packaging. The back of the card contains a unique card number
and a magnetic stripe. As a security measure, it also has a silver sticker that can be scratched off to reveal a PIN. The fraudster quickly scratches off the sticker and uses his phone to snap a photo of the card. He then replaces the scratch-off
sticker with an identical sticker — one of many he purchased in bulk on eBay. After returning the card to its packaging, the fraudster puts it back on the display rack and leaves the store.
With the card number and PIN, the fraudster now has everything he needs to access the card. However, gift cards generally cannot be used until they are activated — usually by a cashier at the point of sale. Therefore, the fraudster must wait until the
card is purchased and activated. Several times a day, the fraudster uses the card issuer’s website to check the balance. Some fraudsters use specialized software to automatically perform this task. Others simply call the number printed on the back
of the card. After the fraudster confirms that the gift card is active, he quickly sells the card on eBay for $80.
In the example above, the back of the card contained both a card number and a magnetic stripe. Some gift cards contain a magnetic stripe but no visible card number. In such cases, fraudsters use a magnetic stripe reader to reveal the card number. Magnetic
stripe readers are inexpensive and widely available.
Alternatively, instead of stealing numbers from physical gift cards, fraudsters can obtain card numbers by hacking an issuer’s website. Hackers often deploy bots to test millions of number combinations until they find an active card number with a positive
balance. In 2017, hackers used a bot called GiftGhostBot to attack nearly 1,000 websites in a search for active gift card numbers.
Most gift cards are purchased well in advance of the birthday or holiday. In addition, the recipient of the card often does not attempt to use it for several days or even months. This gives fraudsters plenty of time to drain the card, either by using
it themselves or selling it to a third party.
Balance confirmation scams
Fraudsters also target consumers who have listed a gift card for sale on a website such as eBay or Craigslist. The fraudster contacts the seller and expresses interest in buying the card. The fraudster then asks the seller to call the card issuer with
the fraudster on the line, in a three-way call, to confirm the card balance. The seller thinks the buyer wants proof that the card hasn’t already been used. In fact, the fraudster wants to record the touch tones the seller enters during the call.
Using the recording, the fraudster can decipher the card number and use the card without paying for it.
Requesting gift cards as
In May 2018, the U.S. Federal Trade Commission issued a warning about fraudsters who call consumers, impersonating someone else, and ask for payment in gift cards. The fraudsters often claim to work for the IRS, say that the consumer is subject to immediate
arrest for delinquent taxes, and demand payment in the form of a gift card from iTunes, Google Play, Amazon, Walmart, Target or another vendor. Alternatively, the fraudster might claim to be an employee of another government agency, a tech support
representative or a family friend. In all cases, the fraudster convinces the consumer that the situation is urgent and demands immediate payment by gift card.
While this scam might seem easy to spot, it has been surprisingly effective, probably because these fraudsters are well trained. But luckily this scam is easily avoided. According to the FTC, “Anyone who demands payment by gift card is always, always,
always a scammer.”
Other gift card scams
Other scams involving gift cards include:
- Selling used, counterfeit or nonexistent gift cards via online marketplaces
- Buying gift cards, quickly draining their value and then canceling the payment
- Cashiers who make a switch at the register, keeping the active card for themselves and giving the customer a worthless card
- Gaining access to a victim’s credit card account and cashing in the victim’s reward points for gift cards
- Phishing emails that offer free gift cards as bait to obtain the victim’s personal or financial information
Tips for preventing gift card
Consumers should follow these tips to avoid gift card scams:
- Buy gift cards only from reputable vendors.
- When possible, buy gift cards online directly from the issuer.
- When buying a gift card from a reseller, make sure the reseller has a guarantee policy.
- If possible, avoid gift cards that are displayed in easily accessible areas (e.g., ask for a card that was stored behind the counter).
- When selecting a gift card from a display rack, choose a card from the least accessible area of the rack.
- If there is a stack of gift cards, choose one from the middle of the stack.
- Before buying a gift card, carefully inspect the card’s packaging and PIN sticker to ensure that they have not been tampered with.
- Watch the cashier scan and activate your card.
- If you receive an activation receipt, make sure the number on the receipt matches the card number.
- Use gift cards as soon as possible.
- Check gift card balances frequently.
- Keep the gift card receipt for as long as the card has a positive balance.
- When possible, register the gift card on the issuer’s website.
- Do not allow anyone to listen in or look over your shoulder as you check your card balance.
- Contact the card issuer immediately If your gift card balance is lower than expected.
- Remember: Anyone who demands payment by gift card is a scammer.