7 Ways to Stop Ecommerce Gift Card Fraud & Bot Attacks

When birthdays or holidays roll around and the perfect gift remains elusive, digital gift cards often save the day. They’re convenient, easy to purchase and give recipients the freedom to choose exactly what they want.

But that same convenience makes gift cards a prime target for fraudsters. Someone using stolen payment details can buy a digital gift card and redeem or resell the code within minutes.

For ecommerce merchants, that’s one example of a growing problem. According to Signifyd data, fraud pressure associated with gift cards increased 74% year over year as of October 2026.

As gift card fraud pressure rises, how can you keep gift cards easy to buy and use while making it harder for fraudsters to exploit them? It starts with recognizing the warning signs and knowing when a purchase, refund or redemption needs a closer look.

Why are gift cards a target for fraud?

Digital gift cards give fraudsters a quick way to turn stolen payment details into spendable value. Once they receive the code, they can use it themselves or sell it to someone else without waiting for a package or arranging a pickup.

“Stolen gift cards are like instant cash, making them one of fraud’s key currencies. They’re a prime target because they’re anonymous, easy to resell or cash out and difficult to claw back.”

— April Richards, director of risk intelligence at Signifyd

Several characteristics make them especially attractive:

• Fast delivery and redemption: Digital gift cards can be delivered and redeemed almost immediately.
• Easy to transfer and resell: Anyone with a valid gift card code and PIN can often redeem its value, allowing fraudsters to transfer or resell stolen codes fast.
• Fewer fulfillment signals: Digital gift cards don’t require physical delivery, removing shipping-related information merchants typically use to assess transaction risk.
• Difficult to trace: Gift cards can be transferred or redeemed without the same identity verification associated with traditional payment cards, making it harder to identify who ultimately uses the funds.
• Easy to exploit at scale: Fraudsters can use bots to automate gift card purchases and test thousands of gift card numbers and PINs through enumeration (brute force) attacks, allowing them to target large volumes of gift cards with minimal effort.

Considering the global gift card market is projected to reach $865 billion by 2030, fraudsters have plenty of incentive to exploit these vulnerabilities in a few key ways.

Common types of gift card fraud in ecommerce

How fraudsters can carry out gift card fraud schemes

Fraudsters can combine automation with account takeover (ATO) to target gift cards. An organized fraud ring may use bots to test stolen login credentials across customer accounts. Once inside an account, a fraudster can buy gift cards with a saved payment method or spend an existing balance. In either case, the first warning sign may appear at login, before you see a purchase or redemption.

Seven ways to prevent gift card fraud

Stopping gift card fraud requires more than limiting how many gift cards customers can purchase. Criminals can exploit vulnerabilities across checkout, customer accounts, gift card systems and refund processes, so you need controls that address each point of risk.

1. Assess fraud risk before approving gift card purchases

Before approving a gift card order, compare the amount and payment activity with what you know about the buyer. A $500 order might be routine for a business that buys employee gifts every December. If the buyer tried several payment cards before one went through, that same order deserves a closer look.

When you have little history with a shopper, activity across other stores can help you assess the purchase. For example, Signifyd’s Purchase Optimization draws on patterns across thousands of merchants in its Commerce Network to help you decide if you should approve an order.

Also, if you accept orders from AI shopping agents, show the shopper the gift card amount and recipient’s email address when they confirm the order. If the agent later adds a gift card or changes the recipient, ask the shopper to approve the change before you send the code.

2. Limit automated attempts at checkout and balance lookup

Limit how quickly a visitor can retry a failed payment at checkout or submit card numbers and PINs on your balance lookup page. If a visitor checks 20 different gift card numbers in seconds, they may be using a bot to find one with a balance.

To check for signs of automation, look at how the visitor entered those numbers, including their typing patterns and mouse movements.

3. Verify suspicious account activity before a gift card purchase or redemption

Pay attention to what happens in the account just before a gift card purchase or redemption. Say someone logs in from an unfamiliar device, changes the account email and immediately tries to buy a gift card with a saved payment method. That sequence gives you reason to verify the shopper’s identity before sending the code.

Consider using a solution like Signifyd’s Account Integrity to evaluate logins and changes to account details to help you decide when to ask for that extra verification.

4. Restrict who can issue, activate or reload gift cards

Limit each employee’s access to the gift card functions they need and require multifactor authentication for accounts that can issue cards or change balances. Also keep a record of each adjustment so you can check who made it and why. 

If an employee adds $200 to a card, for example, you should be able to trace that credit to a paid order, an approved refund or a documented promotion. Investigate any increase you can’t match to an authorized transaction.

5. Verify refund eligibility before issuing gift cards or store credit

Match each refund request to the original order and check whether you’ve already issued a refund. If your online return policy requires the customer to send an item back, verify what arrived before issuing the credit.

If the customer says an item was missing from their delivery, start with the order and fulfillment records. When those records don’t explain the discrepancy, the customer’s history can add context. Leverage a solution like Signifyd’s Returns Assurance to help you assess the claim using the customer’s purchase history and patterns of similar claims across merchants.

6. Check promotional eligibility before awarding gift card value

If you offer a $25 gift card for referring a new customer, confirm that the customer completed the qualifying purchase before issuing the reward. Then check who earned it. A group of accounts can refer one another to collect gift cards intended for bringing genuine customers to your store. If several accounts claim the offer from the same device, trace the referrals. A shared device could belong to a household. A series of new accounts referring one another and sending every gift card to the same recipient gives you a clearer reason to investigate.

7. Review gift card activity with your provider

If a third party manages your gift cards, agree on how you’ll investigate a missing balance before a customer reports one. Decide who can pull the transaction history, who can freeze any remaining funds and how you’ll match the provider’s records to your own. That way, when a customer reports an empty card, you can check whether the correct amount was loaded and, if it was, when and where it was spent. Those details help you narrow down what happened and choose the right control to revisit.

Which industries are most targeted by gift card fraud?

Grocery, fashion, gaming and electronics ecommerce retailers are frequent targets of gift card fraud. The following examples show where the warning signs can surface.

Grocery example: A gift card added after checkout

A fraudster successfully carries out a phishing attack, obtaining a victim’s credit card information. The criminal then places a small online grocery order, buying a few low-cost items — like an energy drink and a banana — using the stolen credit card. The transaction seems legitimate and the card is processed, passing through the grocer’s basic fraud checks easily. 

Once the order is approved, the fraudster modifies it, adds a $100 gift card to the cart and pays the difference with the same stolen card. After the in-store shopper receives the order confirmation, the fraudster contacts them via text or phone call, urgently asking them to share the gift card codes from the order. Once the fraudster has the gift card details, they drain the funds immediately. Later, they may claim they never received the gift card, leaving the grocer or delivery platform on the hook for the loss.

Fashion example: A referral ring accumulates gift cards

A fraud ring spins up hundreds of email accounts and sends referrals among them to cash in on a customer referral promotion offered by a luxury retailer. The fraudsters then stack referrals, birthday and sales promos, and over a few months, buy thousands of gift cards through the retailer’s third-party gift card vendor. The ring then uses the cards to buy hundreds of thousands of dollars of inventory before the retailer detects the fraud or can trace the buyers.

Gaming example: Stolen payment details fund purchases of digital codes

A bad actor uses a skimmer on a self-service kiosk to steal credit card information. After they’ve subtly collected these details, they use them to purchase gift cards online, targeting high-value “dual-threat” gift cards — ones that can be used for multiple purposes. Once the fraudster gets the gift card codes, they typically use them to buy gaming merchandise (like Steam or PlayStation codes) and a meal (“I’ll take an extra large supreme pizza and a liter of Mountain Dew for pick-up.”) or resell them in bulk on the black market.

Electronics example: A compromised account buys gift cards

A fraudster acquires a list of compromised accounts from a dark web marketplace. They use automated bots to test the validity of thousands of accounts on a popular electronics retailer’s website. These bots quickly cycle through different combinations of usernames and passwords to uncover valid login credentials, bypassing manual checks and speeding up the ATO fraud process. 

Once the fraudster successfully takes over an account, they avoid buying high-ticket electronics that would trigger fraud alerts. Instead, they use the account’s saved payment method or a stolen credit card to buy gift cards. This method lets the fraudster avoid immediate detection and benefit from a high return, often selling the sought-after gift cards for up to 90% of their face value.

How Signifyd helps you assess gift card purchases

Two customers can buy the same $100 gift card for very different reasons. One is sending a birthday gift. The other is using a stolen payment method. The amount in the cart gives you little basis for telling them apart.

Signifyd brings together the shopper’s activity during the session, their account history and patterns across the Commerce Network. That context helps you decide which gift card orders to approve and which deserve a closer look.

Want to see our solutions in action? Schedule your demo today.

FAQs

How much does gift card fraud cost merchants?

If a fraudster buys a $100 gift card with stolen payment details and spends the balance, a chargeback can cost you the full $100 plus a dispute fee and staff time. If your processor charges per authorization attempt, bot attacks can also run up fees even when you decline the purchases.

Excessive fraud and dispute rates can also trigger additional scrutiny and fees under programs like Visa’s Acquirer Monitoring Program (VAMP).

Does gift card fraud pressure rise during the holidays?

It can. According to Signifyd data, gift card fraud pressure was 13.3% higher in December 2025 than in December 2024. As more shoppers buy gift cards for friends and family, fraudulent purchases can be harder for merchants to spot among legitimate orders.