Free tools Windows power users keep installed
One-click scans. No signup required.
Gift cards are not universally “easy to hack,” but their balances can be stolen in ways that range from simple tampering to account compromise and sophisticated attacks on retailer systems. The most important rule is straightforward: treat the card number and PIN like cash. Never give them to someone who contacts you unexpectedly, and inspect physical cards before buying.
The warning in the title comes from a Dark Reading article published October 24, 2009, which covered research by UK security consultancy Corsaire. Its findings remain useful historical context, but the specific weaknesses described applied to particular systems and older technologies—not every gift card sold today.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Amazon eGift Card - Amazon Logo | $50.00 | Buy on Amazon |
| 2 |
|
Amazon eGift Card - Happy Father's Day | $50.00 | Buy on Amazon |
| 3 |
|
Amazon eGift Card - Happy Birthday | $50.00 | Buy on Amazon |
| 4 |
|
Visa Physical Gift Card $200 (plus $6.95 Purchase Fee) | $206.95 | Buy on Amazon |
| 5 |
|
Visa Physical Gift Card $100 (plus $5.95 Purchase Fee) | $105.95 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What does it mean to “hack” a gift card?
Gift-card theft does not always involve malware, encryption cracking or a dramatic database breach. “Hacking” is often used as a catch-all for several different events:
- Credential theft: Someone copies the card number or PIN from a physical card, receipt, packaging or digital message.
- Cloning: Older magnetic-stripe cards may be copied if their track data is exposed. The 2009 Corsaire research discussed this risk in specific implementations.
- Guessing identifiers: A weak balance-checking service or predictable card-number system could allow attackers to test large numbers of combinations. Do not attempt to probe these systems; doing so may be illegal and can harm other customers.
- Account takeover: An attacker gains access to a retailer, email or marketplace account containing gift cards.
- Retailer or processor compromise: Poorly secured APIs, administrative tools, employee accounts or backend systems can expose balances or redemption data.
- Social engineering: A scammer persuades the victim to buy a card and voluntarily disclose its number and PIN.
For ordinary consumers, the last category—and physical tampering—are usually more actionable concerns than advanced card cloning.
#1 Best Overall
- Amazon.com Gift Cards never expire and carry no fees.
- Multiple gift card designs and denominations to choose from.
- Redeemable towards millions of items store-wide at Amazon.com or certain affiliated websites.
- Available for immediate delivery. Gift cards sent by email can be scheduled up to a year in advance.
- No returns and no refunds on Gift Cards.
Why criminals target gift cards
Gift cards are attractive because they behave much like cash once the number and PIN are known. They can often be spent quickly, transactions may be difficult to reverse, and the victim may continue holding the physical card even after its balance has been drained. Stolen balances can also be resold or converted into merchandise that is easier to move.
The Federal Trade Commission (FTC) warns that scammers can use the card number and PIN without possessing the plastic card.
Five ways gift-card balances are stolen
1. Physical tampering before purchase
A criminal may remove or damage a protective sticker, copy the card number or PIN, and return the card to a display rack. The legitimate buyer then loads money onto it. The criminal monitors the card or uses the copied details to spend the balance.
This is not necessarily an internet hack. It is often credential theft that occurs before the card is activated. A card can look normal enough to buy while its details have already been exposed.
Rank #2
- Amazon.com Gift Cards never expire and carry no fees.
- Multiple gift card designs and denominations to choose from.
- Redeemable towards millions of items store-wide at Amazon.com or certain affiliated websites.
- Available for immediate delivery. Gift cards sent by email can be scheduled up to a year in advance.
- No returns and no refunds on Gift Cards.
The FTC advises buyers to examine the packaging, stickers, scratch-off areas and card number for signs of alteration. If one card looks suspicious, choose another or shop elsewhere. See the FTC’s guidance on checking gift cards before purchase.
2. Scams that trick people into disclosing the number and PIN
This is one of the most common and preventable patterns. A scammer may impersonate:
- the IRS, Social Security Administration, police or another government agency;
- a technology-support representative;
- your employer or boss;
- a relative or friend in an emergency;
- a utility company threatening disconnection;
- a romantic partner;
- a prize, refund or overpayment service; or
- a phone, internet or television provider offering a fake discount.
The story changes, but the warning signs are consistent: unexpected contact, urgency, secrecy, instructions to buy a particular brand, pressure to stay on the phone and a demand for the card number, PIN or a photograph of the back.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The FTC says gift cards are for gifts, not payments. Government agencies, legitimate businesses and real technical-support companies do not demand payment by gift card. Its January 2026 alert about fake-boss requests specifically explains that the number and PIN may be enough for a scammer to access the funds.
Rank #3
- Amazon.com Gift Cards never expire and carry no fees.
- Multiple gift card designs and denominations to choose from.
- Redeemable towards millions of items store-wide at Amazon.com or certain affiliated websites.
- Available for immediate delivery. Gift cards sent by email can be scheduled up to a year in advance.
- No returns and no refunds on Gift Cards.
3. Digital-card and account compromise
Digital cards remove some physical-tampering risks but introduce others. A delivery email can be intercepted, a retailer account can be taken over, a code can be copied from a screenshot, or a recipient can accidentally forward the code or post it publicly. Malware, phishing pages and malicious browser extensions may also expose an account session.
Reduce account-related risk by using a unique password for the retailer, enabling multifactor authentication where available, buying from the issuer or retailer directly, and avoiding unnecessary forwarding of gift-card emails. Multifactor authentication mainly reduces account-takeover risk; it is not a universal guarantee that a gift-card balance can be recovered.
4. Weaknesses in retailer or processor systems
The 2009 Corsaire research described potential weaknesses involving magnetic-stripe data, visible card information, receipts and packaging, predictable card numbers, balance-checking websites, administrative consoles and web applications.
Recommended Free Tools
Those findings should be treated as historical examples, not proof that every modern card system remains vulnerable. In general, a retailer or processor should protect card identifiers and PINs, use unpredictable numbering, rate-limit balance checks, secure administrative access, monitor unusual redemption activity and protect employee accounts. Attackers may also exploit insecure APIs or integrations rather than the card itself.
Rank #4
- Gift Cards are shipped active and ready for use.
- This card is non-reloadable. No cash or ATM access. Funds do not expire. If available funds remain on your card after the valid thru date has passed, please call customer service for a replacement card. A one-time purchase fee applies at the time of checkout. No fees after purchase.
- To access your card information safely, type the complete website address shown on your Gift Card (MyGift.GiftCardMall.com) directly into your browser's address bar. Don't use search engines or shortened versions of the website address, as these may lead you to fake or fraudulent sites. Do not provide any Gift Card details (example: Card Number) to someone you do not know or trust. If you believe you've reached an illegitimate website, contact cardholder service at 1-888-524-1283. Be cautious of phishing sites, there are a variety of scams in which fraudsters try to trick others into paying with gift cards.
- To report your Lost or Stolen Physical Visa Card, call Customer Service 24/7 at 1 (888) 524-1283 to cancel your Gift Card as soon as you can. You will be asked to provide the Gift Card number and other identifying information.
- Use your Visa Gift Card in the U.S. everywhere Visa debit cards are accepted, including online.
5. Resale and redemption fraud
Stolen cards and balances may be sold through unknown marketplaces or converted into goods for resale. A heavily discounted card is not automatically fraudulent, but an unusually large discount, an unfamiliar seller or a request to move payment off-platform should prompt caution. A buyer may receive a counterfeit, already redeemed or fraudulently obtained card with little practical recourse.
How to buy a gift card more safely
- Choose a trusted source. Prefer the retailer or issuer directly over an unfamiliar third-party marketplace.
- Inspect the card. Look for scratched-off PIN areas, removed stickers, damaged packaging or altered numbers.
- Ask for help if something looks wrong. A cashier or manager may be able to inspect the card or select one from a more secure supply.
- Keep the receipt. It can help establish the purchase if the balance is stolen.
- Record the details privately. Photograph the card and receipt if useful, but do not store the image in a public or shared location.
- Pay by credit card when practical. A credit card may provide stronger dispute options than cash, debit or cryptocurrency, although it does not guarantee recovery of a stolen gift-card balance.
- Activate or register promptly. If the issuer offers registration, it may help associate the card with an account, but it is not a universal recovery guarantee.
- Check balances only through official channels. Type the issuer’s known website address yourself or use the phone number printed on the card. Do not follow links supplied in unsolicited messages.
- Share the card through a trusted channel. Never send the number and PIN to an alleged government official, employer, support agent or stranger.
Physical versus digital cards
| Type | Advantages | Main risks |
|---|---|---|
| Physical | Convenient to give in person and useful for recipients without an online account | Retail-display tampering, exposed PINs, lost receipts and weaker practical dispute options after cash purchases |
| Digital | Fast delivery and no plastic card to lose | Email or account compromise, phishing, screenshots, forwarding and publicly shared codes |
Neither type is automatically safer. The better choice depends on whether the purchase and delivery channel can be trusted and whether the recipient can protect the code.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if the balance has been stolen
Act immediately. Recovery is not guaranteed, but delay can make it harder to freeze remaining funds or investigate transactions.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Contact the issuer immediately. Use the official website or phone number, not contact details supplied by a suspected scammer.
- Provide evidence. Have the card number, receipt, purchase date, amount, store details and any photographs or tampering evidence ready.
- Request a freeze and investigation. Ask whether the issuer can stop remaining funds, review redemption transactions or reimburse the loss.
- Secure related accounts. Change passwords for the retailer and email account if compromise is possible, and enable multifactor authentication.
- Report the fraud to the FTC. Use ReportFraud.ftc.gov.
- Notify the retailer or store. Report where the card was purchased and preserve the receipt.
- Escalate serious cases. For a large loss or possible identity theft, contact local law enforcement and monitor financial accounts.
- Preserve communications. Keep texts, emails, phone numbers, receipts, photographs and transaction records.
Do not assume the issuer must provide a refund. Recovery depends on the issuer, card type, timing, evidence and circumstances. The FTC recommends asking the issuer for the money back, but it does not promise reimbursement. Its reporting guidance explains the process.
Best Value
- Gift Cards are shipped active and ready for use.
- This card is non-reloadable. No cash or ATM access. Funds do not expire. If available funds remain on your card after the valid thru date has passed, please call customer service for a replacement card. A one-time purchase fee applies at the time of checkout. No fees after purchase.
- To access your card information safely, type the complete website address shown on your Gift Card (MyGift.GiftCardMall.com) directly into your browser's address bar. Don't use search engines or shortened versions of the website address, as these may lead you to fake or fraudulent sites. Do not provide any Gift Card details (example: Card Number) to someone you do not know or trust. If you believe you've reached an illegitimate website, contact cardholder service at 1-888-524-1283. Be cautious of phishing sites, there are a variety of scams in which fraudsters try to trick others into paying with gift cards.
- To report your Lost or Stolen Physical Visa Card, call Customer Service 24/7 at 1 (888) 524-1283 to cancel your Gift Card as soon as you can. You will be asked to provide the Gift Card number and other identifying information.
- Use your Visa Gift Card in the U.S. everywhere Visa debit cards are accepted, including online.
Who can reduce the risk?
Consumers
Consumers should protect the number and PIN, inspect cards, reject payment demands by gift card, keep receipts and report losses quickly.
Retailers
Retailers can use tamper-evident packaging, secure card displays, train staff to recognize coercive scams, monitor activation and redemption anomalies, restrict balance-checking abuse and protect administrative systems.
Issuers and processors
Issuers and processors should use unpredictable identifiers, protect PINs, rate-limit automated checks, detect rapid draining and unusual redemption patterns, and provide fast freeze and dispute procedures.
The FTC’s Stop Gift Card Scams campaign includes prevention materials for retailers, law-enforcement agencies and community organizations.
What the 2009 warning got right—and what is dated
The original Dark Reading report correctly identified that gift-card systems can expose a valuable secret: whoever controls the card number and PIN may control the balance. It also highlighted attack surfaces such as magnetic stripes, receipts, balance-checking services and retailer administration.
What is dated is the implication that one broad technical recipe applies to all gift cards. Modern cards, digital delivery systems and issuer controls vary widely. Some attacks described in the original report were theoretical, and backend manipulation would require knowledge of a retailer’s internal systems.
The current lesson is more precise: gift cards are convenient because they function like cash, and that makes their credentials valuable. The biggest consumer danger is often not a Hollywood-style hack. It is a tampered card, an exposed code or a scammer who convinces someone to hand over the balance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
