Home / Knowledge hub / Gift card fraud
Knowledge hub
Gift card fraud
Draining or guessing gift card balances before the real owner uses them.
What it means
Gift card fraud is the theft of stored value from gift cards and vouchers. Attackers guess valid card numbers and codes, check balances in bulk, then spend or resell whatever they find before the real owner does. Some also exploit redemption flows to spend one card twice.
The attack works because a gift card is bearer value: whoever holds the number and code can spend it. If an online balance check answers freely, a script can try thousands of combinations and keep the hits. This is a form of brute force with a direct payout.
Why it matters
The loss is paid in cash or goods, and customers blame you, not the thief. A parent who gifted a card finds it empty, support absorbs the complaint, and the business refunds or loses the customer. Resellers can launder stolen value through your own checkout, so you also carry the dispute and reputation cost.
Weak card codes are a design flaw that cannot be patched later without reissuing every card already sold. Balance-check and redeem endpoints are also targets for bot traffic and card testing, which can overload them even when no card is guessed, and the bill for that traffic is yours.
How it shows up
You meet it at balance-check pages, redemption at checkout, card activation, and reload flows. The repeated weaknesses are short or patterned codes, a balance check with no limit on attempts, errors that reveal whether a number exists, and a redeem step that can run twice at the same time.
Make codes long and random, generated with a secure random generator. Limit attempts per client and per card, return the same message for wrong and unknown cards, add a challenge after repeated failures, and make redemption atomic. Test by trying many invalid codes and by redeeming one card from two sessions at once.
Questions people ask
Gift card fraud, answered
How do attackers find valid gift card numbers?
Mostly by trying many combinations against a balance-check or redeem page and keeping the ones that answer. Short, sequential or patterned codes make this far easier. Long random codes and attempt limits make it impractical.
Does a PIN or security code make cards safe?
It adds a second value to guess, which helps, but only if attempts are limited. A short PIN with unlimited tries can still be brute-forced. The limit on attempts matters as much as the length of the code.
How do we limit balance-check abuse?
Rate limit by client and by card, add a challenge after repeated failures, and give identical responses for unknown and wrong cards. Log the failures, because a spike is the earliest sign someone is running a script.
Can a gift card be redeemed twice?
It can if the check of the balance and the deduction are separate steps, so two simultaneous requests both pass. The fix is to make the deduction atomic in the database. It is worth testing with parallel requests.
Is gift card fraud a security issue or a fraud issue?
Both. The entry point is often an ordinary weakness, such as an unlimited endpoint or predictable codes, and the outcome is fraud. It is usually fixed in code and watched by fraud monitoring together.
Sources
Where this comes from
Related
Terms that sit next to this one
Brute force
Trying passwords or codes over and over until one of them works.
Card testing
Using your checkout to check which stolen card numbers still work.
Limit overrun
Exceeding a cap, such as one redemption per customer, with parallel requests.
Payment fraud
Using stolen or fake payment details to buy from your business.
Enumeration
Working out what exists by asking repeatedly and watching the answers.
Can a balance be guessed?
Balance checks, redemption and activation are small endpoints that guard real value. We test them for unlimited attempts and double spending, and report only what we proved. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.