Gift card draining is a theft in which criminals copy a gift card’s number and PIN, or swap its barcode, while the card is still unsold on a store rack, then spend the money as soon as a buyer loads it. The buyer usually finds out only when the person who received the card tries to use it and the balance is gone.
At a previous job, I bought the team’s holiday gift cards on my way in one December morning: twelve of them, off the rack by a pharmacy register, handed out at lunch. In the second week of January, a colleague stopped at my desk holding hers up like a parking ticket. “Mine says zero. Is this a test?” It wasn’t. I’d also thrown the receipt out during the pre-holiday desk cleanup.
That’s gift card draining, and it reaches business buyers in exactly that order. The card looks fine when you buy it, the person you gave it to finds out weeks later, and the proof you need is already in the recycling.
The timing matters. On October 23, 2026, San Francisco’s City Attorney announced a settlement with the company behind Vanilla gift cards over drained cards, and on November 10, police in Wilton, Connecticut arrested a man outside a store with 36 gift cards and the tools to tamper with them. If your team is about to buy cards for employee or client gifts, here’s what’s happening on the rack and how to keep it off your holiday list.
Gift card draining works by stealing a card’s details before anyone buys it. A thief takes unsold cards from a store display, exposes or copies the number and PIN, reseals the package and puts the card back. Once a shopper pays and the card is activated, the thief can spend the balance without ever holding the card, often before the recipient opens the envelope.
The D.C. Attorney General’s December 2025 consumer alert describes three versions of the scheme:
The Wilton case shows how industrial this can get. According to Wilton, Connecticut police, as reported by Patch, officers found a man in a parked vehicle outside a CVS on the afternoon of November 10, 2026, with 36 gift cards and tools for opening packaging, scraping off the foil over serial numbers and resealing the packages. Police credited store employees with the report and said the arrest may have prevented up to $14,400 in losses. That works out to as much as $400 a card, from one vehicle, on one afternoon.
Upload one recipient list, send digital gift cards in bulk and track every reward from one dashboard, with no store rack involved.
The Vanilla gift card settlement is a $1.525 million restitution fund for California residents who lost money on tampered Vanilla gift cards. San Francisco City Attorney David Chiu announced it on October 23, 2026. It settles a 2023 lawsuit that alleged the cards’ packaging let criminals reach card details before purchase, and that some victims were wrongly denied refunds. InComm, the company that sells Vanilla gift cards, denies any wrongdoing.
According to the restitution notice published with the announcement, you may be eligible if all of these are true:
Claims go through CAGiftCardSettlement.com or by mail, and they must be submitted by February 19, 2027. The notice says payments will be made by about June 19, 2027.
How much you can get depends on your paperwork:
| What you submit | What you may receive |
|---|---|
| Claim form plus complete proof: the receipt, photos of the card front and back, the card’s transaction history and any earlier contact with InComm | The full value you lost |
| Claim form plus some of that proof | Up to 75% of what you lost |
| Claim form only | A flat payment of up to $15 per card, for at most two cards |
If the fund runs short, the claims without proof are the ones that shrink.
Look at what moves a claim from $15 to the full amount: a receipt and two photos. If your company bought Vanilla cards in California for employees in that window, the employee is the recipient who can claim, but the receipt is probably in your finance system, not their desk drawer.
You spot a tampered gift card by checking the package and the back of the card before you pay: a scratched or reapplied security strip, a visible PIN, or a barcode stuck on top of another one. The D.C. Attorney General adds a warning: a card that looks untouched can still be compromised, so inspection lowers the risk without removing it.
Check these before a card goes in your basket:
Where you buy matters too. The D.C. alert suggests stores that lock gift cards in display cases, keep them behind the register, or only add a barcode once a card is sold. Paying by credit card helps if something goes wrong, because your card company may be able to investigate a dispute and get your money back.
Some states now write tamper checks into law. In Maryland, most gift cards sold in stores must come in packaging that can’t be easily opened without showing signs of tampering, with the codes hidden and a printed warning: “Do not sell or purchase if packaging has been broken or indicates tampering” (Maryland Chapter 463 of 2024). The Maryland Attorney General gave retailers until October 1, 2025 to comply.
You lower the draining risk on a bulk order by keeping the cards off the open rack, recording every card before it leaves your hands and handing them out quickly. A 40-card order faces the same tampering as a single card, with 40 times the exposure.
Picture a 40-person team getting $50 cards each. That’s $2,000 of gifts bought in one trip, and if two of those cards were drained on the rack, you won’t hear about it until two people try to use them, probably in January. Here’s how to make that conversation short:
Digital gift cards take the rack out of the picture, though a code works like cash, so a forwarded email or a mistyped address becomes the risk to manage. Our guide on whether it’s safe to buy digital gift cards compares where physical and digital cards can each go wrong, and sending digital rewards securely covers the sending side.
When an employee says their gift card is empty, act the same day: collect the card details, check the transaction history, and report it to the card issuer with your receipt. Issuers can sometimes stop or recover the money if they hear quickly, and your purchase records are what make the claim believable.
If it’s a Vanilla card bought in California in the settlement period and the employee lives there, point them to the settlement too, with your receipt and photos.
With Giftronaut, companies send digital gift cards straight to each recipient by email, SMS (text message, for US and Canadian mobile numbers) or reward link, so no card ever sits on a store rack. Here’s what that changes:
For the rest of the sending side, see our tips for sending e-gift cards securely.
These days, before any card leaves my desk, I photograph its front and back next to the receipt, and the photos go in a folder named for the month. My colleague from that January got a replacement, bought at a counter this time. She still holds every gift card up to the light before she says thank you.
Before your holiday order goes out, decide two things: where the cards will come from, and who keeps the receipt. If the answer to the first is an open rack, give every package the quick check above and photograph each card. If the answer to the second is “whoever bought them,” write a name down instead.
See how teams send holiday gift cards that each employee can choose and redeem.
Yes. Thieves copy the number and PIN, or swap the barcode, while the card is still unsold on the rack. They spend the balance after a shopper buys and activates the card, so the damage happens before the card is ever used.
Check that the protective sticker or foil is intact, the PIN isn’t showing and the barcode isn’t a second label. Look for glue, tears or scuffs on the package. A card that looks fine can still be compromised, so keep the receipt and check the balance soon.
California residents who bought a non-reloadable Vanilla gift card in California between November 1, 2019 and September 30, 2024, or received one bought there then. They must have lost money to unauthorized charges and not been refunded. Claims close February 19, 2027.
Sometimes. Contact the card issuer right away with the card number and receipt, and ask for a refund. If you paid by credit card, your card company may investigate a dispute.
Not completely. Digital gift cards bought from the issuer or a verified platform skip the store rack, where draining happens. But anyone who gets the code can spend it, so treat it like cash and send it only to a confirmed address.
Keep the receipt, any activation receipt and a photo of each card’s front and back. Add a list of card numbers and who received each one. Issuers use them to check a fraud report, and the Vanilla settlement pays more when you have them.