Using OSINT to combat the scourge of gift card fraud

Consumers are sick of it.

They walk into a big box store or drugstore. There, they see a tempting display of gift cards for sale — good at an array of popular retailers. The consumer loads one of these cards with $100, only for the ultimate recipient to find the card has a value of $37. Or $15. Or $0.

Every major retailer knows it: Gift card fraud has reached epidemic proportions.

Americans spend about $200 billion on gift cards each year.[1] Large-scale gift card fraud occurs when organized retail theft (ORT) rings, operating in shops or online, drain value from those cards.

In stores, ORT rings copy numbers and activation codes from cards on display, replacing the scratch-off coating to hide evidence of tampering. Scammers then use specialized bots to scan the issuer’s web site or gift card-management app for signs that the card has been activated. Once it has been, the thieves drain value from the card.

Online, ORT rings use phishing scams, malware, or brute force attacks to access gift card-issuer databases. They deploy bad bots to rapidly attempt different combinations of gift card numbers and codes. Once they hit a valid combination, these credentials can either be used by ORT members themselves or sold online.

The scope of the fraud

Gift card fraud is a widespread crime. According to the Federal Trade Commission, these scams resulted in $217 million in lost value in 2023.[2] In an AARP survey of roughly 2,200 Americans, 23% reported having given or received gift cards with no funds on them.[3]

Why is gift card fraud so prevalent?

• Gift card data is easy to steal, in store or online. Bricks-and-mortar retailers often sell flimsily packaged cards from unsecured racks. These displays make it simple for thieves to copy gift card information. Online, bad bots available for sale on dark web marketplaces can help ORTs conduct brute force attacks on card issuers’ databases. This makes theft of card numbers easier for those who don’t know how to code their own bots.
• They’re easy to sell. If a scammer working online offers a $100 gift card for $75, someone will buy it. Often, the purchaser doesn’t even know the card has been stolen. Instead, criminals write online ads to sound as if the seller has received a gift card for a store he doesn’t like and is willing to sell it at a discount to make a few dollars.
• Gift cards can be used to buy cryptocurrency. These purchases make scam proceeds untraceable.

Widespread gift card fraud harms consumers, retailers

Consumers bear the brunt of gift card fraud. Typically, retailers won’t refund gift cards — even drained gift cards. These cards are cash equivalents: they are not registered to any one user so retailers can’t tell whether a consumer has truly been ripped off, or whether he has simply spent the balance himself and is fraudulently requesting a refund.

And stores have significant reason to fear fraudulent gift card returns. “Claims and appeasement fraud” — actions that exploit stores’ return-and-replacement policies — is one of the fastest growing areas of retail fraud.[4] According to the National Retail Federation, in 2023 this crime cost retailers between $21 billion and $35 billion.[5]

If the burden of gift card fraud lands on the shoulders of consumers, why should retailers care?

Both gift-card fraud and appeasement fraud harm retail reputations — something no one needs in today’s hypercompetitive shopping environment. Victims of gift card fraud may lose trust in the retailer who sold the card, especially when they learn that no refund is forthcoming. Customer dissatisfaction can lead to reduced sales and damage to brand reputation.

In addition, retailers can suffer direct losses from two distinct types of gift card schemes: fraudulent purchases and phony refunds. Criminals engaging in fraudulent purchases use stolen credit card information to buy gift cards, potentially leaving retailers on the hook when the credit card company declines or reverses charges for these purchases. In phony refund scams, thieves steal items from a retailer. They return these items seeking a refund. Unable to produce the receipt needed for a cash refund, they request to be reimbursed via a store-branded gift card — a gift card which can then be resold.

The solution

Fighting gift card fraud is a complicated process. Combatting organized retail crime requires a multi-pronged strategy implemented by a variety of actors.

• To stop thieves from stealing gift cards in bricks-and-mortar stores, card issuers can provide tamper-resistant packaging for their products.
• Retailers can embark on employee training and customer education programs. Store employees can be taught how to spot activities, such as large-volume purchases, that signal gift card fraud. To stop online theft of gift card information, retailers can train employees on how to avoid malware downloads and phishing scams. Retailers can also provide point-of-sale information warning consumers about gift card fraud and educating them on how to spot a card that has been tampered with.
• Government has a role to play. Understanding the prevalence of gift card fraud and its effect on consumers and retailers, Maryland in mid-2024 became the first state to enact a law to prevent draining.[6] The law mandates that all gift cards sold in stores be encased in secure packaging. The law also requires that merchants selling gift cards online register them with the state Division of Consumer Protection. Other states are considering similar laws.
• Technology providers can also help. Open-source intelligence (OSINT) solutions use advanced AI and analytics to identify retail organized crime rings by spotting and tracking suspicious activities indicative of gift card fraud. By processing and analyzing huge amounts of publicly available and commercially available information (PAI/CAI) — including hard-to-reach dark-web data — OSINT solutions help retailers obtain the insight needed to stay ahead of evolving fraud tactics. For example, fraud analysts may use OSINT solutions to spot criminals attempting to sell large volumes of discounted gift cards on social media sites. Analysts may also use these solutions to examine dark-web marketplaces, where scammers sell the bad bots used for online attacks.

Gift card fraud is only one of the crimes committed by ORT rings. To learn more about how OSINT solutions can help retail security managers, loss prevention directors, fraud investigators, and others spot and stop ORT, read our ebook.

Endnotes

1. Business Wire, “United States Gift Card Market Forecasted to Reach $267.3 Billion by 2028 with A 5.7% CAGR, Reveals Q1 2024 Report,” March 2024, https://www.businesswire.com/news/home/20240329728155/en/United-States-Gift-Card-Market-Forecasted-to-Reach-267.3-Billion-by-2028-with-A-5.7-CAGR-Reveals-Q1-2024-Report---ResearchAndMarkets.com 

2. Federal Trade Commission, “Fraud Reports,” July 2024, https://public.tableau.com/app/profile/federal.trade.commission/viz/FraudReports/FraudLosses 

3. Sauer, Jennifer, “America’s Favorite Gift is a Goldmine for Criminals: Survey of U.S. Consumers on Gift Card Scams,” AARP, April 2022, https://www.aarp.org/pri/topics/work-finances-retirement/fraud-consumer-protection/gift-card-scams-survey/?INTCMP=RDRCT-PRI-FRAUD-030322 

4. Appriss Retail, “Appriss Retail 2024 Claims and Appeasements Report,” May 2024, https://apprissretail.com/resources/2024-claims-and-appeasements-report/ 

5. National Retail Federation and Appriss Retail, “2023 Consumer Returns in the Retail Industry,” December 2023, https://nrf.com/research/2023-consumer-returns-retail-industry 

6. CBS News, “Maryland becomes first state to pass law against gift card draining,” July 2024, https://www.cbsnews.com/news/gift-card-draining-maryland-first-state-law/ 

Disclaimer:

All names, companies, and incidents portrayed in this document are fictitious. No identification with actual persons (living or deceased), places, companies, and products are intended or should be inferred.