Gift card draining is the theft of a card's balance between activation and use, and it works because a gift card is near-cash with no chargeback. Bots enumerate card numbers and PINs in batches, testing thousands of combinations against the issuer's balance-check page, and when a card activates, the balance is drained within minutes, sometimes within 60 seconds. The FTC recorded 41,120 gift and reload card fraud reports with $212 million in losses in 2024, and typical losses run $25 to $500 per victim. Homeland Security Investigations runs an operation called Project Red Hook against the organized crime groups behind it, which it estimates have stolen hundreds of millions.
Enumeration is the attack, and the balance check is the door
The attack starts before the card is bought. Gift cards are printed with sequential or predictable numbers, and the PIN is often a short code printed under a scratch panel or derivable from the number. Bots test card-number and PIN combinations in batches against the issuer's balance-check page, which is usually public and usually has no rate limit worth the name. The bots are not guessing one card. They are sweeping ranges of numbers, recording which ones are valid, and waiting. The card sits on a rack in a store, unactivated, with its number already known to a criminal who has never seen it.
Activation is the trigger. The moment a buyer pays at the register and the card activates, the bot that already holds the number checks the balance, sees the funds, and moves them: to another card, to an online purchase, or to a resale marketplace. Balances are drained within minutes of activation, and in the fastest cases within 60 seconds. The victim discovers the theft at the birthday, the holiday, or the checkout, which is days or weeks later, and by then the money has moved through three accounts and the trail is cold. The card is near-cash, which means there is no chargeback to the fraudster and no bank to reverse the transfer.
Related reading on this site: Home and Chargeback Alerts: Ethoca and Verifi, the Warning That Costs Less Than the Dispute cover the neighbouring problems in more depth.
Why the store, the issuer, and the buyer all miss it
The store misses it because the theft does not happen in the store. The card is bought legitimately, activated correctly, and handed to a real customer. Nothing on the shelf looks wrong, and the rack is restocked the same day. The issuer misses it because the balance check looks like a customer checking a gift, and a thousand balance checks a minute looks like a popular product, not an attack, until someone graphs the source addresses and finds a single network doing the checking. The buyer misses it because the card is a gift, and gifts are not checked until they are given.
The organized crime behind it is not a lone hacker. Homeland Security Investigations runs Project Red Hook against the groups involved, and its estimates put the theft in the hundreds of millions of dollars. The operation is industrial: cards are harvested in bulk, balances are drained by automation, and the proceeds are laundered through resold merchandise and mule accounts. A single victim loses $25 to $500, which is small enough that most victims never report it, and large enough in aggregate to fund an organization.
What actually stops it, and what does not
Rate limiting the balance-check page stops the enumeration, and it is the cheapest fix in the whole problem. A page that allows a thousand guesses a minute from one address is not a customer service feature. It is an oracle, and the bots are using it as one. Add a CAPTCHA or a velocity check to the balance lookup, require an account or a phone verification for high-value checks, and the sweep becomes expensive enough to stop. The second fix is at activation: delay the availability of funds by a short window, or require the card to be registered before the balance can be spent online, so the bot that drains the card in 60 seconds finds nothing to drain.
What does not stop it is warning the buyer. Telling customers to check the balance immediately after purchase helps the individual and does nothing about the attack, because the bot is faster than the buyer and the buyer is not the target. The target is the issuer's balance-check page, and the fix belongs to the issuer, not the victim. A retailer that sells gift cards should ask its issuer three questions: is the balance check rate limited, is enumeration monitored, and is there a delay between activation and online spend. If the answer to all three is no, the retailer's gift cards are funding the next Project Red Hook case.
Frequently asked questions
How do thieves drain a gift card they never touched?
Bots enumerate card numbers and PINs in batches against the issuer's public balance-check page, recording which numbers are valid before the cards are bought. When a card activates at the register, the bot sees the balance and drains it, sometimes within 60 seconds.
How much money is lost to gift card fraud?
The FTC recorded 41,120 gift and reload card fraud reports with $212 million in losses in 2024. Typical losses run $25 to $500 per victim, and Homeland Security Investigations estimates organized groups have stolen hundreds of millions.
Why is there no chargeback on a drained gift card?
Because a gift card is near-cash. Once the balance is spent, there is no bank to reverse the transfer and no dispute process that returns the money to the fraudster's victim. The cardholder bears the loss.
What stops gift card draining?
Rate limiting the balance-check page stops the enumeration, which is the cheapest fix. A delay between activation and online spend, or requiring registration before the balance can be spent online, also breaks the attack, because the bot finds nothing to drain in its 60-second window.