Bots and Gift Card Balance Checking Attacks
Gift card balance checkers are a quiet target: bots test stolen or guessed card numbers at scale, and drained balances surface as customer complaints weeks later.
A gift card balance checker looks harmless: a small form, a card number, a balance. To a bot operator it is a free testing service. Stolen card details, guessed numbers, and cards skimmed from other breaches can be checked quietly, and the valid ones sold or drained before the real owner spends them.
Balance checking abuse rarely shows up in traffic headlines, which is why stores miss it. This guide covers how the checking works, the log patterns that reveal it, and defences sized to a small form with an outsized risk.
Why balance checkers attract bots
The checker answers a valuable question, is this card worth anything, at machine speed, with no purchase required. That makes it ideal for validating stolen inventories. A human checks one card occasionally. A bot checks thousands, and keeps only the ones with money on them.
Gift cards are bearer instruments in practice: whoever holds a valid number and any required PIN can spend the balance. Validation is therefore most of the crime. The spending can happen anywhere, later, and looks like an ordinary customer.
Read the log pattern
Checking abuse has a shape: bursts of requests to the balance endpoint, many failed numbers per successful one, addresses that never browse the store, and sessions that touch nothing but the checker. Legitimate checking clusters around holidays and after gift card promotions, from normal browsing sessions.
Compare checker traffic against gift card sales and redemptions. A store whose balance checks run at ten times its redemption volume does not have unusually curious customers. It has a validation service running for someone else.
Slow the checker without punishing owners
Rate limits per address and per card, challenges after a small number of attempts, and requiring the PIN or a second detail the receipt holder has all raise the cost of bulk checking while barely touching a real owner checking one card.
Consider showing partial information: a balance band or a require sign in for exact balances are stronger steps, weighed against the friction for recipients who received the card as a gift and have no account. The right setting depends on the stores fraud history, but unlimited anonymous checking is rarely it.
Respond when drained balances appear
A cluster of customers reporting empty cards is the late symptom. Preserve the checker logs before they rotate, look for the validation pattern in the weeks before the drains, and involve the gift card provider, since the same inventory is often tested across many stores.
Notify and reissue affected customers promptly. The stores handling of drained balances is a trust event far larger than the sums involved, and slow, doubtful responses convert a fraud problem into a reputation one.
Related reading
If this topic is useful, these earlier guides go deeper on connected questions: Bot Traffic During Early Access and Presale Events, Reading Bot Traffic in Returns and Exchange Portals, and Telling Search Crawlers, Shopping Agents, and Harmful Bots Apart in Your Logs.
Frequently asked questions
Why do bots target gift card balance checkers?
Because the checker validates stolen or guessed card numbers for free at machine speed. Cards with balances can then be sold or drained. Validation is the valuable step, and the checker performs it anonymously.
What does balance checking abuse look like in logs?
Bursts of checker requests, high failure ratios, addresses that never browse anything else, and check volumes wildly above redemption volumes. Real owners check occasionally, inside normal shopping sessions.
How can stores slow bulk checking without hurting owners?
Rate limits per address and card, challenges after a few attempts, and requiring the cards PIN or a second detail. An owner checking one card barely notices. A bot checking thousands is priced out.
What should a store do when customers report drained cards?
Preserve checker logs immediately, look for the validation pattern, involve the gift card provider, and reissue affected customers promptly. Speed and generosity here decide whether fraud becomes a reputation story.