Bot Traffic on Gift Card Balance Check Pages: The December Fraud Rehearsal
Balance check pages let anyone test a card number for value, which makes them a favorite bot target for validating stolen cards. What the traffic looks like and how stores respond without blocking real recipients.
A gift card balance checker is a small, helpful page with an ugly second use. To a bot operator holding thousands of card numbers from breaches and scams, it is a free validation service: submit a number, learn whether it holds value, sell or drain the good ones. Stores see the rehearsal in their logs weeks before the holiday drain, if they look at this page at all.
Balance check traffic deserves its own watch, separate from checkout bot metrics, because the patterns, the timing, and the right defenses are different, and because blocking it badly punishes the most innocent visitor a store has: someone checking a card they were just given.
What validation traffic looks like in the logs
Expect high volumes of sequential or patterned card numbers, checks from data center networks at machine regular intervals, a success rate far below human checking, and sessions that do nothing else on the site. Human recipients check one card, maybe twice after mistyping, then go shopping. Validation bots check hundreds of numbers and never browse. The ratio of balance checks to gift card sales is a simple health metric: when checks multiply while sales stay flat, someone is testing inventory that is not theirs.
Why the spike comes before the holidays
Stolen and counterfeited card stock is validated ahead of peak season for two reasons: valid cards are worth more when recipients are about to spend, and holiday traffic gives attackers cover. A store that only watches balance checks in December is watching the fire, not the rehearsal. October and November anomalies in this traffic are an early warning most security reviews miss because the page belongs to no team in particular.
Defenses that stop testing without blocking grandma
Rate limit by card, by network, and by session, and require the PIN or access code wherever the card system supports it, since numbers alone should never be enough to reveal a balance. Challenge only suspicious patterns rather than every check, and provide a clear alternative route, such as phone support, for anyone challenged in error. Log and alert on validation style patterns as a named rule, so the rehearsal triggers a response while there is still time to act.
What to do when you find a validation run
Preserve the logs, identify which card ranges were probed and which returned value, and work with your gift card provider on monitoring or reissuing exposed ranges before they are drained. Review whether any drained cards share the probed ranges, because that link decides whether you are looking at an attempt or a breach in progress. Then fix the page's defenses before the season, since a discovered checker gets revisited.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: How Bots Distort Black Friday Waitlists and Early Access Lists, Bot Traffic in Your Email Signup and Lead Magnet Logs, and Bot Traffic on Branded Search and Why It Inflates Your Click Costs.
Frequently asked questions
Why do bots target gift card balance checkers?
Because the page answers the one question a thief needs: is this card number valid and worth anything. Validated cards can be sold or drained quickly, and the checking itself is cheap, automated, and easy to hide in normal traffic.
How can a store tell bot checks from real recipients?
By pattern: many sequential or patterned numbers, high failure rates, no browsing or shopping in the session, data center origins, and volumes that rise without any rise in gift card sales. A real recipient checks one card and then shops.
Will protecting the balance checker inconvenience customers?
It should not, if defenses are risk based: rate limits and challenges aimed at patterned, high volume checking, while a normal single check passes untouched. Requiring the card's PIN or access code adds one small step that protects every legitimate holder.
When should stores review balance check traffic?
Monthly as a routine, and closely from October onward. Validation runs often precede holiday draining by weeks, so an autumn review is the difference between catching a rehearsal and refunding drained cards in January.