Gift Card Draining: How It Works and Who Owns the Chargeback
Gift card draining is when someone tampers with an unsold card on a store shelf, records its number, and empties the balance once a real buyer activates it. When that stolen balance later pays for an order, the chargeback lands on the merchant who accepted the payment, not on the retailer that sold the card.
I've assembled representment evidence for disputes on my own stores, and the reason code decided everything about what I could send. The fraud codes that apply here ask for proof no merchant can produce.
Read the mechanism below and you'll know which merchant pays, and which checkout controls cut your share.
Key takeaways
What is gift card draining?
Gift card draining is rack tampering, where someone records an unsold card's number and PIN, reseals it, then empties the balance once a buyer activates it. Americans lost $1 billion to these scams over two years, and reporting ties them to organized crime groups based mostly in China.
The scheme runs on a waiting window. A card sits on the rack for days or weeks between the tampering and the sale, and nobody can spend a card that holds nothing yet. So the fraudster runs a script to check the balance, then moves the second it funds.
One distinction decides whether this is your problem at all.
Draining attacks unsold stock on a shelf, before any customer reaches your checkout. Card-testing runs stolen numbers straight through that checkout instead, and ghost tapping is a different scheme entirely, closer to wireless pickpocketing.
Our guide to gift card fraud covers card-testing at depth, and this piece stays on the rack-tampering version.
How gift card draining works
Draining works by copying an unsold card's number off the rack, then spending the balance the moment a real buyer loads it. Four steps get a fraudster there:
- Pull an inactivated card: lift it off the display rack.
- Expose and record the number: slice the carrier open to read the number and PIN.
- Reseal and return it: hide the tampering and put the card back.
- Monitor and drain: check the balance until it funds, then spend it.
Every step depends on two things. The carrier has to reseal well enough to pass a shopper's glance, and the fraudster has to check the balance more often than the retailer checks the rack. That gap is why the money is gone before anyone notices.
Picture the version described by Taylor, a printing supplier in gift card programs.
Someone opens a card's paper carrier with a craft knife and photographs the number underneath. They tape it shut and slide the card back. Weeks later a shopper buys it, loads $100 on, and the balance goes in minutes.
Draining sits inside a wider FTC category. Gift card scams of every kind cost consumers $217 million in 2023, then about $100 million in the first half of 2024.
A shopper can still catch a tampered card in the store, because slits in the packaging and tape residue both show before purchase. That check stops working the instant the card is activated and emptied.
What happens when a drained card funds a purchase
Spend a drained balance at your checkout and you own the chargeback, because you processed a real sale the balance owner never approved. The card network charges back whoever took the payment, and the retailer that sold the tampered card sits nowhere in that chain.
The dispute files as true fraud, and that label decides your odds. The cardholder's claim here is honest, because they never authorized what the fraudster bought. So the code lands in the card-absent fraud family, and answering it means proving the balance owner approved the purchase.
You cannot prove what never happened.
Say a customer pays for a $75 order with a balance drained two weeks earlier.
You ship the order on time. The real balance owner goes to use their card, finds it empty, and disputes the charge. Your records show a clean sale and a delivered package, and none of it answers the reason code.
So stopping the loss before it becomes a chargeback is the only thing that pays here.
A pre-dispute alert reaches you when the cardholder disputes with their bank, before that dispute becomes a chargeback. That leaves you a window to refund and keep the ratio hit off your account.
Run the numbers on your own volume to see what that risk costs.
One case falls outside this. A fraudster who spends the balance at the retailer that sold the card involves no second merchant, so no chargeback exists, only a loss that retailer absorbs.
How merchants can reduce exposure to drained gift cards
Velocity limits, an activation delay, and card code plus address checks are what cut your exposure to a drained balance. The tampering happens long before the card reaches you, so your controls all sit at checkout:
- Velocity limits: cap how fast a newly activated balance can be spent.
- An activation-delay window: hold first use for a set window after funding.
- Card code and address checks: require both where the payment method supports them.
All three catch the same behavior. A drained balance gets spent fast after activation, usually as a full-balance order on a card with no history behind it.
Flag that pattern at checkout and you stop the order before it ships. After it ships you lose the goods and the chargeback both. Write the rule against your gift-card-funded orders in Shopify, Stripe Radar, or your gateway's rules engine, and enforce the activation delay in the same place.
These controls stop most drained-balance orders, and some still get through. A patient fraudster who spends a small amount slowly clears a velocity check, and that leftover risk is what an alert catches after checkout instead of before.
FAQ
Is draining the same as gift card fraud?
Draining is one specific scheme, while gift card fraud is the whole category that contains it. That category also covers card-testing at checkout and phishing people into reading card codes aloud.
Is ghost tapping the same as gift card draining?
No. Ghost tapping reads payment data off a contactless card or phone wallet at close range, while draining needs physical access to an unsold card on a shelf.
Can a merchant spot a drained card at checkout?
No reliable real-time check exists. A drained balance authorizes exactly like a legitimate one, so your only signals are behavioral, such as how fast the balance gets spent.
Do state gift card laws protect merchants here?
No. Those laws govern how retailers package, display, and label the cards they sell, and none of them change which merchant a card network charges back.
