Gift cards are one of the most popular holiday purchases and remain in demand year round, Customers like gift cards because they’re a convenient and flexible way to send someone a gift while still being a bit more personal than cash. Merchants like them because they’re a great way to generate sales and create customer loyalty.

Unfortunately, fraudsters like gift cards too. There are a variety of schemes they can employ to take advantage of the fact that gift cards have few of the security features that modern credit cards do. Many of these schemes will result in chargebacks, with the merchant left holding the bag. How can merchants protect themselves from gift card fraud?

The global gift card market was worth over $295 billion in 2020, and the United States accounts for around half of that. Despite the risks, it makes sense that merchants would want to offer gift cards—customers want them, they increase sales, and they can be a good marketing tool. The important thing is to understand the ways in which fraudsters can exploit gift cards so that you can take precautions to minimize the risk and empower your customers to keep their funds safe.

Why Is Gift Card Fraud Growing?

COVID-19 had led many merchants and customers alike to enter the world of e-commerce for the first time. While online shopping was already on the rise before 2020, the lockdowns around the world turned that growth into an explosion.

This, in turn, led more fraudsters to target e-commerce merchants and customers, taking advantage of a lack of knowledge about common methods of fraud. Whether through a stolen card number or some other scheme, more fraudsters than ever are using gift cards in their crimes.

What Types of Gift Card Fraud Exist?

Gift cards are untethered to individual identities, hard to trace, easy to convert to cash or resellable goods, and ubiquitous. Better yet for fraudsters, they’re not bound by the same extensive regulations as credit and debit card transactions. It’s no wonder so many different scams have developed around gift cards. Here are the main ones you should be aware of, along with some advice about how to defend yourself:

Gift Card Refund Fraud

If a customer ever wants to return a product and asks to have it refunded to a gift card, watch out. It could be part of a scheme to extract untraceable funds from a stolen credit card. Here’s how it works:

Fraudsters use a stolen card number to make an online purchase, then send it back for a refund and ask for the funds to be put on a gift card. Eventually, the payment card’s true owner will report the unauthorized transaction and request a chargeback. The merchant loses twice the transaction amount plus all the fees and hidden costs associated with a chargeback. Meanwhile, the fraudster has a gift card they can use or sell without issue.

Merchants can avoid this by always insisting that funds be returned to the same payment card used to make the purchase. Sometimes customers may claim that they no longer have the card, but this is often a red flag for potential fraud. Even if it’s true, the funds can still be returned to the old card account and the customer can claim them from the issuer.

Gift Card Number Theft

Fraudsters can virtually print money for themselves by hacking into a company gift card database to steal card numbers and activation codes. This can be done via brute force hacking methods, malware, or using phishing or social engineering attacks against company employees. These last two methods are by far the most common.

“Merchants who manage their own gift card data must make sure robust information security technology is in place to defend it against hackers and should track gift card numbers and their usage carefully to look out for suspicious activity”

All employees with access to company computers or systems should receive cybersecurity awareness training, ideally with an occasional refresher. Merchants can also run tests such as simulated phishing emails or social engineering attempts to assess the effectiveness of the training. Areas of weakness can be identified and emphasized in future training.

The most important things for employees to remember are to keep an eye out for unusual or suspicious emails and to never plug an unknown device into a computer. Leaving a USB drive stamped with the target organization’s logo in a parking lot is a common method of attack, and even the US Department of Defense has fallen victim to it.

Buying Gift Cards With Stolen Credit Cards

The most widespread form of gift card fraud is also the simplest.

Fraudsters simply use stolen credit card numbers to buy gift cards online and use or resell them before the merchant gets hit with the inevitable chargeback. This is one of the easiest ways for a fraudster in possession of stolen payment credentials to make a quick profit.

Merchants who find themselves dealing with this kind of fraud need to look at the software tools, operational procedures, and customer service training that is allowing fraudulent purchases to go through. Things like AVS/CVV verification, 3-D Secure, and recognizing some of the telltale signs of fraudster behavior can help you stop these transactions before they go through and become a problem.

Some merchants may benefit from anti-fraud tools that use machine learning to identify potentially fraudulent transactions, assigning them a risk score based on information gathered from past transaction data.

Account Takeover Gift Card Purchases

When fraudsters gain access to a customer’s account, they may have free reign to make purchases with stored payment credentials. In many cases, however, this kind of fraud is discovered before the merchandise is shipped out, since customers usually receive an email confirming any purchase.

A more reliable way for fraudsters to wring actual cash out of a stolen account is to buy mass quantities of gift cards, which can be used immediately. Most merchants would benefit from putting a system in place to automatically flag large or repeated gift card purchases for review.

Physical Gift Card Tampering

When you sell physical gift cards in open retail locations, you’re open to a few different kinds of schemes that involve tampering with them. While there are various protections in place to prevent this, most of them are relatively easy for determined or experienced fraudsters to get around.

“One method involves copying one gift card’s barcode onto other cards, so that when shoppers purchase and activate the cloned cards, the fraudster has access to those funds.”

Fraudsters may also copy down the card numbers and activation codes on cards still on the sales rack, using stickers to cover up any scratch-off coverings they removed. As soon as an honest customer purchases and activates one of the cards, the fraudster can start using it.

When merchants aren’t in direct control of the retail environment in which their cards are sold, it’s difficult for them to prevent this kind of exploitation. Smaller merchants may be able to be more restrictive about how and when customers have access to unsold gift cards. Customers should be aware that it’s always safer to buy gift cards online, direct from the merchant, and that any time you buy a gift card from a retail location you should change its PIN as soon as it is activated.

Gift Card Fraud Leads to Chargebacks

Remember, a gift card security problem is a chargeback problem waiting to happen — or more likely, a chargeback problem already happening. The customers whose payment cards get used to fund the gift cards used in these schemes are virtually guaranteed to dispute the charge sooner or later, and even the best chargeback representment strategies won’t do much to help you when true fraud is the reason.

Don’t treat gift card management like an afterthought. Conduct information security reviews and do what you can to enable as much tracking and monitoring as you need to identify the sources of gift card fraud and take whatever action might be necessary to stop it.

If you’re struggling to prevent gift card fraud or any other chargeback issue, you may want to look into hiring a chargeback management firm. They can help you set up the appropriate anti-fraud measures for your business, as well as prevent and fight chargebacks in general.

Frequently Asked Questions