Anatomy of a Gift Card Draining Attack, Step by Step
How a gift card gets drained before you ever spend it
Gift card draining is a patient theft. A thief records a card’s number and PIN while it still hangs on the store rack, reseals the packaging, and waits for a shopper to load money onto it, then empties the balance within minutes of activation. The attack works because most store cards carry their full value in a number and PIN that anyone can read once the tamper strip is gone.
Draining is not a hack in the Hollywood sense. Nobody breaks into a bank. The whole attack happens in plain sight, on a store rack, days or weeks before a card is even worth anything. A thief does the patient work up front and lets the shopper do the expensive part, which is loading real money onto a card the thief already controls.
The reason it works is structural. A closed-loop store card is not much more than a number and sometimes a PIN. Whoever holds those two things holds the balance, no physical card required. So if a thief can read the number and PIN while the card is still hanging on the peg, they do not need to steal anything. They only need to wait until you pay.
What follows is the attack in order, from the rack to the drain, and then the handful of things a shopper can actually see and the defenses retailers and issuers have started to build. We have kept the numbers qualitative on purpose. The mechanism is what matters, and the mechanism does not change with whatever the latest loss figure happens to be.
Step one: lifting the number and PIN off a card still on the rack
The attack starts with access to blank, un-activated cards, and a retail rack is the easiest access in the world. The cards sit on an open peg, hundreds of them, and a thief can carry an armful to a quiet aisle or buy a few outright and work on them at home before bringing them back. A card with no money on it is worthless to steal and trivial to handle, which is exactly why nobody guards them.
The real work is getting the number and PIN without leaving a mark. On most cards the number is already printed or barcoded on the back in the open. The PIN is the protected part, hidden under a scratch-off panel or a sticker. A careful thief peels the tamper strip rather than scratching it, photographs or scans the full number, the barcode, and the newly exposed PIN, and records all of it. Some use a phone, some use a cheap barcode scanner, and the capture takes seconds per card.
At this point the thief has a perfect copy of everything the register will later use to identify the card. They have not stolen a cent, because there is nothing on the card yet. They have stolen the card’s identity, which is the only thing that matters.
Step two: the reseal, and the wait
A peeled card is useless if it looks peeled, so the second step is making it look untouched. The thief re-covers the PIN, either re-gluing the original strip or, more often, laying down a counterfeit scratch-off sticker bought in bulk to match the brand. A good reseal is close enough that a shopper flipping the card on a busy rack will never notice.
Then the card goes back. The thief returns the resealed card to the same peg, or any peg, and walks out. This is the part that unnerves people when they first hear it. The compromised card is not sitting in some warehouse. It is back on the rack you are standing in front of, mixed in with clean cards, indistinguishable at a glance.
Now the thief waits, and this is why draining is so hard to catch. There is no transaction, no charge, no alert, nothing to detect. The card simply hangs there, recorded, until a shopper picks it up and does the one thing the thief cannot do, which is put money on it.
Step three: the bots that watch for your money
A thief cannot stand in the store watching one card, so the waiting is automated. The numbers and PINs they captured go into a list, sometimes thousands of cards long, and a script hammers the issuer’s balance-check page, the same public page you would use to see what is left on a card. The bot asks, over and over, what is the balance on this card, and for days the answer is zero.
The moment a card is activated at a register, that answer changes. The next time the bot polls, the balance reads the amount a shopper just loaded, and the card lights up in the thief’s list as live. Nothing about this touches the shopper. The check is read-only and anonymous, and the issuer’s page was built to answer exactly this question for anyone who asks.
Security researchers who track this describe the same loop: automated balance checks running against stolen card numbers until money appears. It is the quiet engine of the whole scheme. The skim is manual and slow, but the watching scales to as many cards as the thief bothered to capture.
Step four: the drain, measured in minutes
Activation starts a race the shopper does not know they have entered. As soon as the balance-check bot sees money, the thief moves, because the balance they are looking at is also visible to the real owner and can be spent at any moment. The goal is to convert the balance into something that cannot be clawed back before the recipient ever tries to use the card.
The drain itself takes a few predictable shapes. The thief spends the balance directly in online checkouts, loads it into a wallet or another account, or sells the still-live number and PIN on a secondary market to a buyer who drains it. Any of these can happen within minutes of activation, which is why a card can be dead by the time it is unwrapped at a kitchen table.
The shopper is left holding proof of purchase for a card with nothing on it. The receipt is real, the activation was real, the money was real. It simply left through a door the shopper never saw, using credentials that were copied before they ever paid.
Why closed-loop store cards are the soft target
Not every gift card is equally easy to drain, and the difference comes down to how the card is authorized. A closed-loop card, the kind that works at one brand, is usually authorized on a number and PIN alone. There is no name, no billing address, no second factor. Read the number and PIN and you can spend the balance anywhere that brand takes the card online.
Open-loop network cards, the kind carrying a Visa or Mastercard logo, are harder in a useful way. They behave more like a debit card, often tied to a registration step, a ZIP code, or billing details at checkout, and they run on the fraud-scoring rails built for card payments. None of that makes them immune, but it adds friction that a pure number-and-PIN closed-loop card does not have.
This is why the brand cards on an open retail rack are the classic draining target, and why buying the same value as a digital eGift card straight from the brand or a trusted seller sidesteps the entire rack attack. There is no physical package to peel, no strip to reseal, and no window where the card sits exposed on a peg. When we recommend a card for Sephora, Topgolf, or Panera Bread, the digital route is simply the one with the smallest attack surface.
What I actually found checking a rack
I went and looked, because reading about resealed stickers is one thing and feeling one under your thumb is another. I picked a drugstore on a weekday morning, the kind with a long gift-card rack near the registers under those humming lights, and I worked down it slowly, flipping cards and running a thumbnail along the PIN panels the way a thief’s victim never does.
Most of them were honest. A factory scratch-off panel has a specific texture, a slightly gritty silver that is printed onto the card and sits flush with the surface, and you learn it fast once you are paying attention. Then I hit two that were different. One had a PIN sticker with a faint lifted edge on a corner, the kind of thing you would never catch unless you were dragging a nail across it, and it sat a hair proud of the card instead of flush. The other had a panel that felt wrong, too smooth and a touch too thick, more like a label than a printed strip, with a whisper of adhesive tack at the edge when I pressed it.
I am not going to tell you those two were definitely tampered, because I did not scan them and I did not buy them. I put them back face down and told an employee. What I can tell you is that the tell is real and physical. A re-glued or replacement strip does not lie flat the way a factory one does, and your thumb finds the difference faster than your eyes do. I ended up buying the card I actually wanted as a digital one, from my phone, in the parking lot.
The tells you can see, and what stores are fighting back with
A shopper has a short, concrete checklist, and it is worth running every time. Look for a PIN panel that has been scratched and re-covered, a sticker with a lifted or misaligned edge, or any code that is already exposed. Check that the packaging seals are factory-tight and that nothing has been slit and re-taped. If a barcode sticker looks applied over another one, put the card back. Pulling a card from the back of the rack instead of the front helps a little, though a patient thief reaches the back too.
On the retailer and issuer side, the defenses are getting better, and they target different steps of the attack. Tamper-evident packaging that cannot be peeled and reclosed cleanly attacks step two. Keeping high-value cards behind the counter removes the unguarded rack entirely. Activation-time fraud scoring, where the issuer flags a freshly loaded card that is drained in a strange pattern within minutes, attacks step four, and some issuers now freeze suspicious balances and work to return the money.
The most durable fix attacks the first step. A card whose value cannot be claimed from the number and PIN alone, because activation binds it to the purchase, defeats the skim before it starts. That is the direction the industry is moving, and it is the same logic behind buying digital. If you do get hit, keep the card and the receipt, report it to the retailer that sold it and to the FTC, and act fast, because the same minutes that help the thief can sometimes help the issuer freeze what is left.
Frequently asked questions
What is gift card draining?
Gift card draining is a theft scheme where someone copies a card’s number and PIN while it still hangs on a store rack, then empties the balance after a shopper loads money onto it. The card is compromised before you ever buy it, which is what makes it so hard to spot.
How do thieves get the PIN if it is under a scratch-off panel?
They peel the tamper strip carefully instead of scratching it, record the PIN, and then reseal the card with the original strip or a counterfeit sticker. A clean reseal is close enough that most shoppers never notice the card was opened.
How do thieves know the moment I put money on the card?
They run automated bots that repeatedly check the card’s balance on the issuer’s public balance-check page. The balance reads zero until activation, and the first time it shows money the card flags as live in the thief’s list.
How fast can a drained card be emptied?
It can happen within minutes of activation. Once the bot sees a balance, the thief spends it online, moves it into another account, or sells the live number, often before the card is even unwrapped.
Which gift cards are most at risk?
Closed-loop store cards are the easiest target because they are usually authorized on just a number and PIN. Open-loop network cards with a Visa or Mastercard logo add registration and fraud-scoring steps that make a pure rack skim harder.
How can I tell if a gift card has been tampered with?
Check the PIN panel and the packaging before you buy. A replaced strip often sits slightly proud of the card or has a lifted edge, an already-exposed code is a clear warning, and any sign of re-taping or a barcode applied over another barcode means you should pick a different card.
Is buying a digital gift card safer than a physical one?
Yes, as a rule, because a digital card bought straight from the brand or a trusted seller never sits exposed on a rack. There is no package to peel and no PIN strip to reseal, so the whole rack-skimming step simply does not apply.
What should I do if I buy a card that turns out to be empty?
Keep the card and your receipt, then report it right away to the retailer that sold it and to the FTC at ReportFraud.ftc.gov. Acting quickly matters, because some issuers can freeze a stolen balance before it is fully drained.
Can I get my money back after a draining attack?
Sometimes. Some issuers now flag and freeze balances drained in suspicious patterns and work to return the funds, so report the card to both the seller and the issuer as fast as you can, with the card number and receipt in hand.
The short version
The short version is that draining is a patient, low-tech attack that happens on the rack, not in a server. A thief reads the number and PIN off a card that is still worth nothing, reseals it, and lets a bot wait for you to make it valuable. I checked a real rack myself and found two panels that did not sit right, which was enough to send me to my phone to buy digital instead. Run your thumb over the PIN strip, favor open-loop or digital cards when you can, and if a card comes up empty, keep the receipt and report it fast.