Gift card draining is a theft in which criminals copy a gift card’s number and PIN, or swap its barcode, while the card is still unsold on a store rack, then spend the money as soon as a buyer loads it. The buyer usually finds out only when the person who received the card tries to use it and the balance is gone.
At a previous job, I bought the team’s holiday gift cards on my way in one December morning: twelve of them, off the rack by a pharmacy register, handed out at lunch. In the second week of January, a colleague stopped at my desk holding hers up like a parking ticket. “Mine says zero. Is this a test?” It wasn’t. I’d also thrown the receipt out during the pre-holiday desk cleanup.
That’s gift card draining, and it reaches business buyers in exactly that order. The card looks fine when you buy it, the person you gave it to finds out weeks later, and the proof you need is already in the recycling.
The timing matters. On October 23, 2026, San Francisco’s City Attorney announced a settlement with the company behind Vanilla gift cards over drained cards, and on November 10, police in Wilton, Connecticut arrested a man outside a store with 36 gift cards and the tools to tamper with them. If your team is about to buy cards for employee or client gifts, here’s what’s happening on the rack and how to keep it off your holiday list.
How does gift card draining work?
Gift card draining works by stealing a card’s details before anyone buys it. A thief takes unsold cards from a store display, exposes or copies the number and PIN, reseals the package and puts the card back. Once a shopper pays and the card is activated, the thief can spend the balance without ever holding the card, often before the recipient opens the envelope.
The D.C. Attorney General’s December 2025 consumer alert describes three versions of the scheme:
- Scratch and cover. The thief scratches off the back of the card to reveal the code, then covers it up again.
- Barcode swap. The thief replaces the card’s barcode with one from a card they already control, so the money you load goes to their card instead.
- Scan and wait. The thief records the codes of unsold cards and waits for someone to buy and activate one.
The Wilton case shows how industrial this can get. According to Wilton, Connecticut police, as reported by Patch, officers found a man in a parked vehicle outside a CVS on the afternoon of November 10, 2026, with 36 gift cards and tools for opening packaging, scraping off the foil over serial numbers and resealing the packages. Police credited store employees with the report and said the arrest may have prevented up to $14,400 in losses. That works out to as much as $400 a card, from one vehicle, on one afternoon.
What is the Vanilla gift card settlement, and who can claim?
The Vanilla gift card settlement is a $1.525 million restitution fund for California residents who lost money on tampered Vanilla gift cards. San Francisco City Attorney David Chiu announced it on October 23, 2026. It settles a 2023 lawsuit that alleged the cards’ packaging let criminals reach card details before purchase, and that some victims were wrongly denied refunds. InComm, the company that sells Vanilla gift cards, denies any wrongdoing.
According to the restitution notice published with the announcement, you may be eligible if all of these are true:
- You’re a California resident.
- You bought a non-reloadable Vanilla gift card in California between November 1, 2019 and September 30, 2024, or someone gave you one that was bought there in that period.
- You couldn’t use some or all of the balance because of charges you didn’t authorize, which you believe came from tampering with the packaging.
- InComm hasn’t already refunded you for that money.
Claims go through CAGiftCardSettlement.com or by mail, and they must be submitted by February 19, 2027. The notice says payments will be made by about June 19, 2027.
How much you can get depends on your paperwork:
| What you submit | What you may receive |
|---|---|
| Claim form plus complete proof: the receipt, photos of the card front and back, the card’s transaction history and any earlier contact with InComm | The full value you lost |
| Claim form plus some of that proof | Up to 75% of what you lost |
| Claim form only | A flat payment of up to $15 per card, for at most two cards |
If the fund runs short, the claims without proof are the ones that shrink.
Look at what moves a claim from $15 to the full amount: a receipt and two photos. If your company bought Vanilla cards in California for employees in that window, the employee is the recipient who can claim, but the receipt is probably in your finance system, not their desk drawer.
How can you spot a tampered gift card before you buy it?
You spot a tampered gift card by checking the package and the back of the card before you pay: a scratched or reapplied security strip, a visible PIN, or a barcode stuck on top of another one. The D.C. Attorney General adds a warning: a card that looks untouched can still be compromised, so inspection lowers the risk without removing it.
Check these before a card goes in your basket:
- The protective sticker or foil over the PIN is whole, flat and hasn’t been lifted or replaced.
- The PIN or code isn’t visible through the package, and nothing on the back looks scratched.
- The barcode sits flat and doesn’t look like a second label on top of the first.
- The package seams show no glue, tape, tears or scuffs, and the card doesn’t slide around inside.
- The rest of the rack. The FTC notes that scammers might tamper with cards in batches, so if one card looks wrong, try a different store and tell the cashier or manager about the card you found.
Where you buy matters too. The D.C. alert suggests stores that lock gift cards in display cases, keep them behind the register, or only add a barcode once a card is sold. Paying by credit card helps if something goes wrong, because your card company may be able to investigate a dispute and get your money back.
Some states now write tamper checks into law. In Maryland, most gift cards sold in stores must come in packaging that can’t be easily opened without showing signs of tampering, with the codes hidden and a printed warning: “Do not sell or purchase if packaging has been broken or indicates tampering” (Maryland Chapter 463 of 2024). The Maryland Attorney General gave retailers until October 1, 2025 to comply.
How do you buy gift cards in bulk without the draining risk?
You lower the draining risk on a bulk order by keeping the cards off the open rack, recording every card before it leaves your hands and handing them out quickly. A 40-card order faces the same tampering as a single card, with 40 times the exposure.
Picture a 40-person team getting $50 cards each. That’s $2,000 of gifts bought in one trip, and if two of those cards were drained on the rack, you won’t hear about it until two people try to use them, probably in January. Here’s how to make that conversation short:
- Buy away from the open rack. Order from the card issuer directly, buy cards kept behind the counter, or send digital cards from a platform you can verify.
- Pay with a company credit card where your policy allows, so you have a dispute route.
- Photograph every card, front and back, next to the receipt before the envelopes go out, and file any activation receipt with it. Issuers and the Vanilla settlement ask for exactly these records.
- Write down each card’s number or serial and who received it. A spreadsheet with three columns does the job.
- Check balances before you hand cards out if the issuer offers a balance check, and hand them out soon after buying.
- Tell recipients to check the balance the day they get the card and to come straight to you if it’s empty. The FTC advises that the sooner you report, the better.
Digital gift cards take the rack out of the picture, though a code works like cash, so a forwarded email or a mistyped address becomes the risk to manage. Our guide on whether it’s safe to buy digital gift cards compares where physical and digital cards can each go wrong, and sending digital rewards securely covers the sending side.
What should you do when an employee says their gift card is empty?
When an employee says their gift card is empty, act the same day: collect the card details, check the transaction history, and report it to the card issuer with your receipt. Issuers can sometimes stop or recover the money if they hear quickly, and your purchase records are what make the claim believable.
- Collect the card and a photo of it. Ask the employee not to throw away the card or its package, and pull your receipt and card photos.
- Check the balance and transaction history on the issuer’s website. Charges your employee didn’t make, often soon after purchase, point to draining.
- Call the card issuer right away. The number is usually on the back of the card, and the FTC keeps a contact list for major gift card companies. Tell them the card was tampered with, give them the card number and receipt, and ask for a refund.
- Dispute the purchase and report it. If you paid by credit card, ask your card company about a chargeback. Report the fraud to the FTC at ReportFraud.ftc.gov, and tell the store where you bought the card.
- Replace the gift. The employee did nothing wrong, and a thank-you shouldn’t turn into their weekend project. Chase the refund on company time.
If it’s a Vanilla card bought in California in the settlement period and the employee lives there, point them to the settlement too, with your receipt and photos.
How can Giftronaut help you avoid gift card draining?
With Giftronaut, companies send digital gift cards straight to each recipient by email, SMS (text message, for US and Canadian mobile numbers) or reward link, so no card ever sits on a store rack. Here’s what that changes:
- Nothing to copy in advance. A Giftronaut prepaid card’s number and PIN are generated at the moment the recipient clicks the redemption link, so nobody can have used the card before then.
- The right person opens it. Before reaching the redemption page, the recipient confirms it’s them with a one-time code sent the same way as the reward.
- The address stays put. The recipient can’t change the email address a reward was sent to; only the sender can correct it and resend.
- Records without the photos. The order history report for a single order exports each recipient’s email, amount and delivery status as a CSV.
For the rest of the sending side, see our tips for sending e-gift cards securely.
Before you buy this year’s holiday gift cards
These days, before any card leaves my desk, I photograph its front and back next to the receipt, and the photos go in a folder named for the month. My colleague from that January got a replacement, bought at a counter this time. She still holds every gift card up to the light before she says thank you.
Before your holiday order goes out, decide two things: where the cards will come from, and who keeps the receipt. If the answer to the first is an open rack, give every package the quick check above and photograph each card. If the answer to the second is “whoever bought them,” write a name down instead.
Frequently Asked Questions
Can a gift card be drained before you even buy it?
Yes. Thieves copy the number and PIN, or swap the barcode, while the card is still unsold on the rack. They spend the balance after a shopper buys and activates the card, so the damage happens before the card is ever used.
How can you tell if a gift card has been tampered with?
Check that the protective sticker or foil is intact, the PIN isn’t showing and the barcode isn’t a second label. Look for glue, tears or scuffs on the package. A card that looks fine can still be compromised, so keep the receipt and check the balance soon.
Who is eligible for the Vanilla gift card settlement?
California residents who bought a non-reloadable Vanilla gift card in California between November 1, 2019 and September 30, 2024, or received one bought there then. They must have lost money to unauthorized charges and not been refunded. Claims close February 19, 2027.
Can you get your money back after gift card draining?
Sometimes. Contact the card issuer right away with the card number and receipt, and ask for a refund. If you paid by credit card, your card company may investigate a dispute.
Are digital gift cards safe from draining?
Not completely. Digital gift cards bought from the issuer or a verified platform skip the store rack, where draining happens. But anyone who gets the code can spend it, so treat it like cash and send it only to a confirmed address.
What records should a company keep when it buys gift cards for employees?
Keep the receipt, any activation receipt and a photo of each card’s front and back. Add a list of card numbers and who received each one. Issuers use them to check a fraud report, and the Vanilla settlement pays more when you have them.
