Gift card scams: how to spot them, what to do in the first hour, and how to report one

A gift card is cash with no name on it, which is exactly why scammers want one. The FTC's advice fits in a sentence: only scammers tell you to pay with a gift card. The rest of this guide is what the scams look like, what to do in the first hour, and who to call.

What are the main gift card scams, and how big is the problem?

The FTC's Consumer Sentinel data book for 2024 lists 41,120 fraud reports where a gift or reload card was the payment method, with $212 million in reported losses. The two previous years were $217 million and $228 million. Gift cards were the most reported scam payment method for several years to 2021, when the FTC's data spotlight put the median loss at $1,000 and Target cards as the brand most often demanded.

Those figures count only people who reported. The FTC itself says most fraud never is. The scams come in four shapes.

The payment-demand scam

This is the one behind most of the money. The caller is the tax authority with an arrest warrant, the electricity company about to cut you off, tech support who found a virus, your manager who needs cards for clients, a grandchild in a jail abroad. The script always ends the same way: go to a shop, buy gift cards, and read the numbers out.

The FTC's rule is absolute: no legitimate business or government agency will ever ask you to pay with a gift card. Anyone who does is a scammer, whatever the story.

The pressure is the mechanism, and it works on people who know better. The call is urgent, the caller stays on the line, and the demand lands in the middle of a day already full of interruptions. The same thing that makes an always-open inbox expensive makes it easy to act on a demand before thinking about it. Hanging up costs nothing; a real agency will write.

Card draining: tampering at the rack

Homeland Security Investigations runs a programme on this, Project Red Hook, and describes how the operation is organised: takers remove unactivated cards, tamperers open the packaging and record the numbers or swap the barcode, placers return the cards to busy shelves, and checkers run balance enquiries until a shopper loads money, then move it out within minutes.

HSI's tampering indicators are specific: tears or paper fibres along the zigzag cut of the pack, a pull tab that is nicked or re-laid, logos or colours that nearly but not exactly match, a PIN cover that is missing, wrinkled or not flat, and packaging that differs from the others on the same hook.

The FTC's advice before buying is the same: check the stickers are intact and the PIN is not exposed, pick a different card if anything looks wrong, consider a different shop since tampering happens in batches, and keep the receipt. Maryland became the first state to require secure packaging for gift cards sold in person, under a law ProPublica reported on in 2024 that took effect in 2025; the industry expected the packaging to roll out nationally rather than vary by state.

Phishing, resale, and the signs you are being scammed

A legitimate voucher message gives you a code. A phishing message asks for one. The text that says a card is waiting, or a balance must be confirmed within 24 hours, links to a page that looks like the retailer and collects the number and PIN. Check balances only on the address printed on the card, typed in by hand. An SMS importer should surface messages that contain a code and never ones that ask for it; how a careful importer filters messages covers the rules.

Second-hand cards are a bearer-code problem. The seller may have the number and PIN written down and empty the card after you pay, or the card may have been drained before it was listed. Buy only from the retailer or a marketplace that guarantees the balance, and spend a resale card promptly.

Across all four, the signs are the same:

• You are told to pay anything, to anyone, with a gift card.
• You are told to keep the call going while you buy, or to tell the cashier the cards are a gift.
• The card's packaging is cut, re-glued or missing its PIN cover, or the barcode sticker sits over another.
• A message asks you to enter a card number and PIN on a website to check, claim or confirm a balance.
• A freshly loaded card shows a zero balance before you have used it.
• A deal on a second-hand card is far below face value from a seller with no history.

Gift card scam: what to do in the first hour

1. Stop contact. Hang up, close the chat, do not read out any more numbers.
2. Call the card company, now. Tell them the card was used in a scam and ask for a refund. Some companies freeze the balance if the scammer has not yet cashed out, and the FTC says the faster you report, the better the chance of getting money back.
3. Keep the card and the receipt. The card number and the store receipt are what the claim needs; photograph both.
4. Report it to the FTC at ReportFraud.ftc.gov, however long ago it happened. Outside the US, report to the national consumer or fraud authority.
5. If the card was drained from the rack, report to the shop as well, and to HSI at GCFraud@hsi.dhs.gov with Project Red Hook in the subject.
6. Change anything the scammer learned: if they had your email, phone or a password, assume they still do.

How to report a gift card scam: who to call

The FTC maintains a list of gift card companies and how to reach them. The entries below are as the FTC published them; check the page before calling, since numbers change.

How to store gift card codes safely

Every scam above ends with someone else reading a code. The defence is to treat the code as cash: never read it out, never type it into a site you did not navigate to yourself, never keep a photo of it in a gallery that syncs, and never forward it in a chat. Keep the amount and the expiry in a list, and the code somewhere it is fetched only when you open that one voucher.

How a wallet app should treat a voucher code sets out the five rules, from fetching codes one at a time to keeping keys out of URLs.

And spend cards promptly. A code that has been seen cannot be re-secured, only emptied first, and a card that sits for years is a card whose number has had years to leak. The expiry rules by country set the floor on how long the money is yours; they do not keep it safe.

How PeakVoucher does it

PeakVoucher's wallet list carries names, values and expiry dates and never the codes; a code is fetched only when you open that voucher, one at a time, and the barcode is drawn on the device from it. The SMS importer lists messages that contain a code and filters out one-time passcodes before the list exists. The assistant can answer questions about the wallet and fetch a code when you ask, but has no tools that spend, change or delete anything.

Hen Eytan · Founder, UPeak

Builds the UPeak apps and writes up the research behind them.