A store rack filled with gift cards

Amid the seemingly never-ending holiday craziness, gift cards can make for easy presents. But you’d better watch out: Cybercriminals have their eyes on them, too.

The New York Police Department recently issued a warning after a major retailer said it discovered gift cards that had been tampered with at a store in that city. If consumers had bought the tampered cards, they would have lost the money loaded onto them. 

Cybercrime experts say that gift card scams aren't a new problem, and they're not exclusive to big cities. Plus, they affect online shoppers, too. Websites offering gift cards for big discounts are often running scams or could be connected to even more nefarious crimes that in some cases have bilked Americans out of their life savings.

More on Cyber Safety During the Holidays

The National Retail Federation estimates that more than half of Americans will buy gift cards this holiday season.

According to the trade group's 2019 survey of holiday shoppers, the average consumer plans to buy three or four gift cards this year and put an average of $47 on each of them. That amounts to about $27.5 billion in holiday gift card sales, the NRF says.

And that's an enticing target for thieves, online and otherwise.

"These guys are professionals," says Richard Henderson, head of global threat intelligence for the cybersecurity company Lastline. And, he adds, they don't need every doctored gift card to be activated in order to be successful.

"Even if they only get someone 1 or 2 percent of the time, they're still going to make a lot of money," Henderson says.

Here’s a look at different kinds of gift card scams and fraud, plus tips to avoid becoming a victim. 

Go to 
Consumer Reports’ 2019 Holiday Gift Guide for updates on deals, expert product reviews, insider shopping tips, and much more.

Many Ways to Tamper With the Cards

The NYPD warning was accompanied by a photo posted to Facebook showing a doctored gift card that had turned up at a New York City store. Someone had taken a bar code from a purchased gift card, made a bunch of official-looking stickers with the bar code, then placed them on cards that hadn't been sold yet.

An unsuspecting consumer could then buy one of the doctored gift cards and load it with money. The money would then go to the criminal’s card instead of the consumer’s.

Crimes like this are tough to track because most victims don’t file reports, says Deputy Inspector Jessica Corey, commanding officer of the NYPD’s Crime Prevention Division. In the case of the recently discovered scam gift cards, they were brought to the attention of the police by the retailer who found them.

“Somebody could gift one of these and not even find out until a month later,” Corey says.

Henderson notes that criminals also copy down gift card numbers, then scratch off the coverings above their PIN, giving them access to card balances once they're activated later on. The bad guys then replace the code coverings with stickers that can easily be bought online. That can make it tough to tell that the cards have been tampered with.

In other cases, criminals will leave the PIN covering intact and instead use online bots or other kinds of computer software to guess the PIN code. In many cases, the codes are just four digits, making them easy for hackers to crack. 

Online Scams

Gift cards have long been the currency of choice for all kinds of cybercriminals, Henderson says. If bought with cash, the cards are untraceable and, unlike the cryptocurrencies that criminals also like to use, they can be bought practically anywhere.

Especially during the holiday season, little-known websites will advertise gift cards for popular retailers at steep discounts. These websites might be using these offers to steal your payment card numbers or other personal information.

And if the gift cards are legitimate, they may have been bought with stolen credit card numbers, or they're being used to launder money generated by other kinds of crimes.

Consumers should never try to use gift cards to pay off alleged debts. If someone asks you to do so, it may be a sign that you're being targeted by criminals.

Corey says the NYPD has seen a huge spike this year in reports of Social Security scams where victims have received calls from people claiming that they represent the agency or some kind of law enforcement agency.

The people tell victims that their Social Security number has been used to open numerous accounts or is involved in some sort of drug-trafficking or money-laundering operation. To protect their money or to avoid being arrested, victims are told to send money to help resolve the situation. According to the NYPD, the most common forms of payment requested are prepaid gift cards, bitcoin, and bank wire transfers.

Losses related to these kinds of scams have already exceeded $6 million this year in New York City alone, Corey says. The problem has become so bad, she says, that some retailers have resorted to posting signs at checkout lines warning of the scams.

“We’re seeing people empty their bank accounts because of these kinds of crimes and, in most cases, they’re not getting their money back,” she says. 

Tips for Consumers

Here are some ways to protect the gift cards you give and receive this holiday season.

Buy gift cards online. Get them directly from retailers, chain restaurants, or other issuers. Criminals don't have easy access to those cards. This is especially important if you're purchasing a high-value gift card.

“The risk is just too great,” Henderson says. “If you can buy through [an official] website, you should do that. It’s exponentially safer.”

Don't buy in-store cards with easily accessible numbers and PINs. If you’ve waited till the last minute and absolutely have to buy a gift card in a retail store, look for those kept behind the counter or in well-sealed packaging, Henderson says.

If the cards are out in the open on a rack, he recommends looking at a wide assortment and inspecting the bar-code numbers to see if there are duplicates or if the packaging has been tampered with. If the cards aren’t in view of surveillance cameras or store employees, get yours somewhere else.

If you receive a card as a gift, change the security code as soon as possible. Register the card when you get home, change the PIN, and don’t delay in using the money. The longer a card sits around, the more likely a cybercriminal is to steal the balance.

Try to get stolen funds back. Some card issuers use cybersecurity defense systems, and they may be able to distinguish between honest and fraudulent transactions on your gift card. So if your card has been drained, call the issuer and ask for reimbursement.

Secure your home computer. Criminals can also gain access to your gift card numbers and PINs by hacking your computer. To help prevent that, make sure your security software is up to date, create and use strong passwords or a password generator, and enable multifactor authentication on every site where it's available. 

How to Avoid Online Scams

Do you know how to protect yourself from online threats? On the "Consumer 101" TV show, host Jack Rico and Consumer Reports' digital privacy expert Thomas Germain play a quiz game to reveal important steps you can take to keep your personal information safe.