Gift Cards, From More Secure to Less Secure

Every year gift cards top many holiday wish lists, but these popular presents are also vulnerable to fraud. Unlike banks, which spend tens of millions of dollars to thwart credit card fraud, retailers have done far less to safeguard the funds loaded on gift cards. There are also no federal protections for gift card theft like the laws limiting consumer liability for debit or credit card losses.

The result, ValuePenguin has found, is a marketplace where too many gift cards have few to none of the security features that protect consumers against threats that range from simply losing the card to falling victim to criminal enterprises that drain card balances, sometimes before the card is even used.

We examined the security features of 62 physical gift cards from major retailers. (E-gift cards, which are more secure, were not included in the survey, because many holiday shoppers prefer giving a physical card. However, almost all cards listed are available as e-gifts, except those with an asterisk.)

Click here to examine the security features of gift cards, store by store.

Our most important finding is that many cards lack any protection against theft or loss. Retailers frequently note in the terms and conditions of their gift cards that consumers should “treat gift cards as cash.” That means if you lose one of these cards, or have it stolen from you, the funds are gone and irreplaceable.

More than 45% of the cards we scrutinized offer no theft and loss protection, according to their fine print; we've ranked all these cards towards the bottom of our listing, since we consider them the least secure that we evaluated. Fortunately, though, more than half of the gift cards in our survey (53%, to be precise) offer to protect against loss or theft, which means the issuer should reimburse the amount left on the card should you report it as missing or stolen. However, even if a card comes with loss/theft protection, the burden of proof can be high. You typically must provide documentation—like an original receipt showing the card purchase and any subsequent receipts using the card—before the store will consider replacing any funds. Still, theft protection is better than nothing and we think it’s the single most important security feature a gift card can have.

More Secure Gift Cards

We used three key fraud protection measures to gauge the security of the gift cards we assessed. They are: whether the cards offer loss/theft protection, in the event that you lose the card or it’s stolen; whether they use PINs for security purposes; and whether, if they allow you to check your card balance online, they do so in a way that would thwart an online criminal.

The cards in this group offer all three measures, which makes them the most secure among the 62 cards we examined. While all have a PIN security code—typically a three- or four-digit number found on the back of the card—a PIN alone offers minimal security, because a criminal who steals your card, or someone who simply finds it, will also have its PIN, which is easily found on the back of a card--concealed, at most, by a scratch-off strip.

Further, sophisticated criminals often use automated bots that cycle through combinations of card numbers and PINs on a retailer’s balance check website. When a match is made with a card that has a balance, the fraudsters quickly sell the card information either on gift card exchanges or online black markets. To secure your balance against such fraudsters, the cards below use CAPTCHA technology , which determines whether a user is human or a bot by requiring the completion of a challenge-response test. That can include typing random letters displayed in a box or clicking on squares that complete an image.

CompanyLoss/Theft ProtectionPIN Available?Balance-Check Security
American EagleYesYesYes
AthletaYesYesYes
Banana RepublicYesYesYes
Barnes & NobleYesYesYes
BJ's Wholesale Club*YesYesYes
Bloomingdale's*YesYesYes
Dillard'sYesYesYes
Dunkin' DonutsYesYesYes
GameStopYesYesYes
GapYesYesYes
Home DepotYesYesYes
JCPenneyYesYesYes
KmartYesYesYes
Kohl'sYesYesYes
Lowe'sYesYesYes
Meijer*YesYesYes
Old NavyYesYesYes
Saks Fifth AvenueYesYesYes
SearsYesYesYes
StaplesYesYesYes
TJXYesYesYes
Toys "R" UsYesYesYes
Walgreens*YesYesYes

* Not available in an e-gift card format.

Gift Cards That Protect Loss, but Lack Online Security

Next in security, after the cards that have all three key security features we deem important, come this group, which lack only secured balance checks. With these cards, you can obtain their balance without encountering any digital checkpoints, such as those that require you to enter letters or numbers, or identify images, within a CAPTCHA box. That makes them more vulnerable than most cards we examined to having their balances drained by online fraudsters. These criminals could access the balance check feature on the retailer's site, and then use automated bots to cycle through card numbers and PINs until they find your card's balance.

However, like the most secure group above, these cards all offer some recourse if the gift card or card balance is lost or stolen. Many require that you provide the card number, PIN and a copy of the receipt showing the original gift card purchase to recoup any losses.

CompanyLoss/Theft ProtectionPIN Available?Balance-Check Security
AMCYesYesNo
Bass Pro ShopYesYesNo
Bed Bath & BeyondYesYesNo
Best BuyYesYesNo
Dick's Sporting GoodsYesYesNo
NikeYesYesNo
NordstromYesYesNo
StarbucksYesYesNo
TargetYesYesNo
Victoria's SecretYesYesNo

Gift Cards With Online Security, but Few Other Protections

The good news with these two subgroup of cards below is that they make it difficult for criminals to use bots to locate activated gift cards with balances. Like the most secure cards we examined, these mostly do this with CAPTCHA technology that requires a human to enter certain information. However, some others instead require users to sign into an existing account or establish a new account before accessing a gift card's balance. While a fraudster theoretically could create a fake account to run bots on the check balance, these retailers can better track and respond to any suspicious balance-checking activity from a logged account, another strong fraud deterrent.

The bad news about this group is one of these measures is pretty much all the security these cards promise, since they all lack the loss or theft protection that would reimburse your account if you lost the card or had it (or its balance) stolen from you.

IKEA is included because it has no online balance check. While that makes it harder to check how much you have on a card, it also secures the card, since fraudsters have no way to determine if it has been activated or has a balance.

CompanyLoss/Theft ProtectionPIN Available?Balance-Check Security
Amazon.comNoNoLog-in
AppleNoYesLog-in
BrinkerNoNoCAPTCHA
Burlington Coat FactoryNoYesCAPTCHA
DardenNoNoCAPTCHA
eBayNoYesLog-in
Google PlayNoNoLog-in
IkeaNoNoSee above
iTunesNoYesLog-in
J. CrewNoYesCAPTCHA
Michael KorsNoYesCAPTCHA
Neiman MarcusNoYesCAPTCHA
NetflixNoNoLog-in
Office DepotNoYesCAPTCHA
Ralph LaurenNoYesCAPTCHA
Walmart StoresNoYesCAPTCHA

Less Secure Gift Cards

Like virtually all gift cards on the market, the cards below have a PIN. However, this feature offers only a small security advantage, since the code is easily accessible (on the back of the card) and, unlike the PINs on credit cards, those below cannot be changed tom increase security.

The values that are on the cards in this group also are largely unprotected, according to the card terms and conditions. Lose the card, or have its value stolen by online thieves, and there is no recourse, at least that's promised.

CompanyLoss/Theft ProtectionPIN Available?CAPTCHA Required?
CoachNoYesNo
Costco*NoYesNo
CVSNoYesNo
ebay.comNoYesNo
Foot LockerNoYesNo
Giant Eagle*NoYesNo
H&MNoYesNo
Kroger*NoYesNo
Levi'sNoYesNo
PetSmartNoYesNo
REINoYesNo
SephoraNoYesNo
Whole FoodsNoYesNo

* Not available in an e-gift card format.

Methodology

In a project completed in late November and early December 2017, we surveyed available U.S. gift cards, and settled on detailing security features for 62 cards. Those we selected were from major national retailers. (We skipped so-called “open-loop” gift cards, such as those issued by Visa, MasterCard, American Express and Discover.) For those we included, we reviewed the card’s Terms and Conditions for explicit mention that the card could be replaced in the event that it is stolen or its balance was breached. We also checked cards for whether a Personal Identification Number, or PIN, or other security measures were required in order to use the card. We also visited the websites of the card retailers to verify that the card balances could be checked online. We also noted if either a CAPTCHA box or account log-in was required to complete the balance check.

Comments and Questions