How do bots turn stolen cards into gift cards?
The gift card is the exit, not the purchase
A stolen card number is inventory, not money. It becomes money only when something is bought with it and resold, and the gift card is the fastest conversion in the store. There is no address to verify, no name to match, no delivery window to wait through. The bot buys the card, gets the code, and the balance is sold on a resale market before the cardholder has checked their statement.
OWASP's Automated Threats taxonomy names this step OAT-012, Cashing Out: buying goods or obtaining cash with validated cards, and it lists gift cards first among the goods, because they are the most liquid. The taxonomy separates the validation step, OAT-001 carding, from the cash-out step for a reason: the merchant who stops the validation never sees the cash-out, and the merchant who misses the validation pays for both.
The resale market sets the price. A $100 gift card balance typically resells for $70 to $85, depending on the brand, which means the operator keeps most of the value and the buyer gets a discount that looks legitimate. The cardholder, the merchant, and the card network split the loss.
Why gift card checkouts are the softest target
A physical product has friction built in: a delivery address that can be checked against the billing address, a signature, a return window. A digital gift card has none of it. The delivery is an email address the bot controls, and the email arrives in seconds.
Visa's merchant guidance names the pattern. Test transactions are often under $10, and the endpoints that attract testers are the ones that validate a card without a purchase: saving a card, a small payment, a donation. A gift card purchase is both a small payment and a validation, so it serves the tester twice.
The volume is the tell. Stripe reported that card testing attempts grew more than 100 times between 2019 and 2022, and at the peak of one wave its fraud tools were blocking more than 20 million card testing attempts per day. Visa puts enumeration at roughly $1.1 billion in annual fraud losses. A merchant who sells gift cards is selling the exit ramp for that traffic.
The two minutes that decide the loss
The bot does not buy one $500 gift card. It buys ten $50 cards, or twenty $25 cards, because a single large purchase trips the velocity rules and a stream of small ones looks like a promotion. The split is deliberate, and it is the shape the defence has to catch.
The first purchase is the test. A $5 or $10 gift card, bought with a card that was stolen hours ago, tells the operator the card is live and the merchant's gift card flow has no extra check. The second purchase is the drain, and by the third the balance is already listed for resale.
The merchant's defence is the delay. A gift card that is held for review on the first purchase from a new account, or delivered after a short hold when the order matches a velocity pattern, costs a real customer minutes and costs the operator the whole run, because the operator's model depends on the balance being spendable before the cardholder notices.
What actually stops the cash-out
Rate limits keyed to the account, the card, and the product, not just the IP address, because the bot rotates IPs and the card is the constant. A velocity rule that counts gift card purchases per card, per account, and per session catches the split purchases that an IP rule misses.
A bot challenge on the gift card flow specifically, not just on login. Visa's guidance says the CAPTCHA should validate on every request that can validate a card, and a gift card purchase is exactly that request.
And the hold. A short delivery delay on the first gift card order from a new account, with a manual review when the order is large or the account is minutes old, is the cheapest control a merchant has. The real customer waits an hour. The bot moves on to a store that does not wait.
Keep reading: How do bots exploit buy-now-pay-later checkout to run up debt in your name?, Card testing on small checkouts: why the $1 charge is the whole attack, and Velocity rules: the five numbers that stop a card testing attack cover the nearby cases in this series.
Frequently asked questions
Why do fraudsters buy gift cards with stolen cards?
Because a gift card has no shipping address, no name check, and no waiting period. The balance is delivered by email in seconds and resold at a discount, turning a stolen card number into cash faster than any physical product can.
How much of a gift card's value does the fraudster keep?
A $100 gift card balance typically resells for $70 to $85, depending on the brand. The operator keeps most of the value, and the cardholder, the merchant, and the card network split the loss when the charge is reported.
Why do bots buy many small gift cards instead of one large one?
A single large purchase trips velocity rules. A stream of small purchases looks like a promotion, so the bot splits the drain into ten $50 cards or twenty $25 cards. A velocity rule keyed to the card and the account, not just the IP address, catches the split.
Should I delay gift card delivery for new accounts?
Yes, briefly. A short hold on the first gift card order from a new account, with a manual review when the order is large, costs a real customer minutes and costs a fraud operator the whole run, because the model depends on the balance being spendable before the cardholder notices.