How to prevent gift card fraud

Gift cards are close to cash, and that is exactly what makes them a target. The FTC reported that gift cards were the payment method people named most often when they lost money to fraud in 2021, accounting for about $148 million in reported losses over the first nine months of that year, a measure of how liquid and hard to trace the value becomes once a card is loaded. For a fraudster holding stolen payment details, a gift card is a clean way to turn someone else's card into spendable value that is hard to trace and easy to resell. For a fraudster chasing signup bonuses, a gift-card promo is one more reward to farm across a pile of fresh accounts. Both problems live on the same online buying flow that any retailer or gift-card platform runs, and both hinge on the same trick: one operator presenting as many separate customers. This guide covers the merchant side, the online accounts and payments behind gift-card fraud, rather than the consumer scams that dominate the headlines.

That distinction matters, because the phrase gift card fraud usually points at the consumer story: someone talked into paying a fake tax bill in gift cards, or a physical card drained off a store rack before it is even sold. Those are real harms, and they are a different job. What follows is about the retailer's own checkout: the accounts buying the cards, the payment details behind those buys, and the device that ties a crowd of plausible customers back to a single operation.

Key takeaways

• On the merchant side, gift card fraud is mostly cashing out stolen payment cards by buying near-untraceable gift cards, plus farming gift-card signup promos and referral rewards across many accounts.
• The move underneath both is multi-accounting: many "different" accounts, each with a fresh email, a different name, and a masked IP, buying cards or claiming a promo as if they were separate people.
• Inspected on its own, a single buyer account clears every check: a valid-looking payment, one card in the cart, a plausible name and inbox. The evasion only shows up when you compare accounts, not when you score them one by one.
• Card verification and purchase-velocity caps catch the loud, repetitive runs, but they never answer the question that decides the case: which of these separate buyers are really the same hands. Device linkage answers it.
• What holds the operation together is the hardware doing the buying. A fraudster mints a fresh inbox or feeds in another stolen card number in seconds, but the device behind the purchases is stubborn and stays put.

What is gift card fraud?

On the merchant side, gift card fraud is the use of a retailer's or gift-card platform's own buying flow to convert stolen or illegitimate funds into gift-card value, or to farm gift-card promotions across accounts that pretend to be different people. The most common version is a cash-out: a fraudster with stolen payment card details buys gift cards, because a gift card holds value that is quick to resell and hard to trace back through the original card. A second version is promo abuse, where signup bonuses, first-purchase credit, or referral rewards attached to gift cards are claimed again and again on fresh accounts.

This is different from the consumer scams that fill the news, where a person is tricked into paying a stranger in gift cards, or a physical card is tampered with on the shelf. This guide covers the online merchant side: the accounts, the payments, and the devices behind gift-card purchases on your platform. The through-line is that a single operator behaves like many customers, so each individual purchase stays inside the rules while the operation as a whole clears far more than any one shopper should.

The merchant side is part of a large total: Juniper Research projects global ecommerce fraud losses rising from $56 billion in 2025 to 131 billion dollars by 2030.

The main tactics of gift-card fraud

Merchant-side gift-card fraud runs on a handful of recognizable tactics, and most of them come back to controlling more accounts, or more payment details, than one person should have:

Tactic	What the fraudster does
Cashing out stolen cards	Buys gift cards using stolen payment card details, turning someone else's card into gift-card value that is quick to resell and hard to trace
Card testing before the buy	Runs many small authorizations to find which stolen card numbers still work, then spends the live ones on gift cards
Gift-card promo and bonus farming	Creates many accounts to claim gift-card signup promos, first-purchase bonuses, or referral rewards that are meant once per customer
Reselling and laundering balances	Sells gift-card balances bought with stolen funds into resale channels, converting the value into cleaner money at a discount
Balance enumeration at scale	Automates many checks against card-number and PIN combinations to find cards that still carry an active balance
Friendly-fraud chargebacks	Buys a gift card, resells or drains it, then disputes the original charge as unauthorized so the value stays while the cost is clawed back

These split into two different problems. The automated pieces, high-volume card testing and balance enumeration, are traffic problems that rate limits and bot management slow at the door. The rest share a human operator wearing many faces: one person, or one small crew, running the accounts, the stolen cards, and the resale behind them. That second problem is where the account-identity signal does its work. The card testing that feeds a cash-out and the multi-accounting that drives promo farming are the same operator, seen from two angles.

Why gift-card fraud is hard to catch

Gift cards sit in an awkward blind spot. The value is as good as cash the moment a card is issued, yet the checkout that issues it still has to judge, in real time, whether the buyer is legitimate. A fraudster only needs each purchase to read as ordinary on its own, and gift-card buys are ordinary by nature: one card, a working payment method, a name, an inbox. Nothing about a lone order announces that the buyer is loading value for resale rather than for a birthday.

Both sides of the problem live in that blind spot. On the cash-out side, a fraudster who has already found live stolen card numbers spreads them thinly, a card here and a card there, so no single account or payment stands out while the balances pile up as near-untraceable gift-card value ready to resell. On the promo side, an operator farming signup bonuses simply needs enough plausible accounts to claim the same reward again and again. The usual guardrails do not close either gap. Email uniqueness falls to plus-addressing and disposable inboxes. IP blocks either miss a buyer who cycles through proxies or wrongly snag a real household on its shared connection. Payment-level checks bite a clumsy stolen card but do little once the numbers are pre-tested and rationed across accounts. The one thing every fake buyer struggles to discard is the machine they work from, and that is the thread most checkout controls never pull.

We ran a wave of look-alike buyer accounts against exactly that thread, each with its own email, a different name, and a masked IP, and they reduced back to a single device the moment we compared them instead of scoring each one alone. A fraudster mints a fresh inbox or feeds in another stolen number in seconds; the machine doing the buying is the part that does not change. That has only become clearer in 2022, when Chrome began reducing the user-agent string and pushing device detail into structured client hints, leaving the surface of an order easier to fake than the device underneath it.

How to prevent gift card fraud

No single control stops gift-card fraud, so prevention layers the buying flow with detection, and each layer covers what the others miss:

• Throttle the scripted buying first. Rate limits, bot management, and a challenge step stop automated card testing and balance enumeration from running at machine speed. It clears out the noise but does nothing about the person quietly working accounts by hand.
• Put weight on the payment step. Address and card verification, issuer responses, and a hold on mismatched or high-risk details make it more expensive to turn a stolen card into gift-card value in the first place.
• Build promos that do not reward repetition. One claim per verified customer, bonuses that are earned or delayed rather than paid on signup, and per-account caps on high-value card purchases drain the profit out of running a stack of fresh accounts.
• Tie the "separate" buyers back together. Against both a cash-out and a farming run, the single most useful test is whether a crowd of independent-looking accounts resolves to one device or one operation.
• Flag masked, bursty buying. Gift-card orders clustered behind VPNs, proxies, and anti-detect browsers, or a rush of new accounts inside a narrow window, point at an operation, since a genuine shopper does not buy from ten hidden connections at once.
• Hold value before it leaves. Parking a suspicious or high-velocity order for a quick manual look stops the obvious operations before the cards activate, and it leaves a record for any chargeback that follows. That same account-linking extends into refund and return abuse, where one operator runs claims across many accounts.

Done together, these keep the checkout open for real shoppers while making a bulk operation far harder to run at a profit.

How ShieldLabs detects the accounts behind gift-card fraud

Underneath a gift-card checkout, ShieldLabs looks at the device and network on every signup and purchase, so the accounts buying cards with stolen funds and the accounts spun up to farm a promo stop looking independent. One JavaScript snippet on your buying flow is enough: each visit comes back with persistent identification, derived from device fingerprinting signals, that holds even after cookies are cleared and the IP is rotated. So when ten "different" buyers, or a wave of promo signups, all map to a single device, that many-accounts-on-one-device pattern behind a cash-out or a farming run is put in front of your team instead of buried for someone to piece together later.

Every visit also carries a risk score from 0 to 100 and the named anonymity signals, VPN, proxy, Tor, and anti-detect browser use, the cover an operator relies on to pass one buyer off as a whole crowd. The same linkage that ties multi-accounting together also catches an established account that turns up on a fresh, anonymized device, a familiar tell when stolen cards and farmed rewards are being cashed out through a checkout. ShieldLabs scores the session and lays out the evidence by name, and you read that pattern and score over the API and webhooks, so your own rules decide which orders to allow, hold, or review. Your first 5,000 identifications are free, with the rest of the detail on pricing.

Sources

1. Federal Trade Commission: Gift card scams
2. Federal Trade Commission, Data Spotlight: Scammers prefer gift cards, but not just any card will do
3. Wikipedia: Credit card fraud
4. Wikipedia: Gift card
5. Juniper Research: Fraudulent eCommerce Transactions to Surpass 131 Billion Dollars by 2030 (2025)