Gift cards are the only thing in your store that turns straight into cash. No pick, no pack, no freight, no returns. You sell a number, and the number is money. That is exactly why fraudsters love them, and it is why gift cards are treated as roughly four times riskier than selling a physical product, according to fraud platform Riskified.
What’s in This Article
Most Aussie founders never think about this until the first bad week. A batch of orders comes through overnight, all gift cards, all just under the free shipping threshold, all from customer accounts created minutes earlier. The codes get redeemed within the hour. Three weeks later the chargebacks land, and the goods those stolen codes bought have already shipped. You are out the product, the payment, and the dispute fee.
The scale is not small. The US Federal Trade Commission put reported gift card fraud losses at a minimum of 212 million US dollars in 2024, and that figure is widely accepted as understated because most victims never report. Closer to home, the ACCC recorded 2.18 billion dollars in total scam losses across Australia in 2025, up 7.8 per cent on the year before. Gift cards sit near the centre of that, because they are the payment method scammers ask for when they want money that cannot be reversed.
The good news is that gift card fraud is one of the most preventable losses in ecommerce. It follows a small number of well-documented patterns, and each one has a specific control. This is the six-layer defence we run with brands inside eCommerce Circle, built for a Shopify store doing somewhere between 40k and 500k a month.
The Three Ways Gift Cards Actually Get Stolen
Before you buy a tool, understand the attack. Almost every gift card loss on a Shopify store traces back to one of three plays, and they need different defences.
- Stolen card purchase. A fraudster buys a gift card using a stolen credit card, redeems the code within minutes, and the real cardholder disputes the charge weeks later. Gift cards are the cleanest laundering path in your store because delivery is instant and there is nothing to intercept. Unlike a physical order, you cannot recall a redeemed code.
- Code enumeration, also called balance draining. Bots hammer your store or your balance-check page with thousands of guessed code combinations per minute, looking for any card with money on it. When they find one, they redeem it or resell it. This is the same machinery behind card testing, just pointed at a different endpoint.
- Refund and returns laundering. A stolen order gets refunded to store credit or a gift card, which converts a disputed transaction into a clean, spendable balance. The Association of Certified Fraud Examiners flags this as one of the most common retail schemes precisely because it looks like ordinary customer service.
There is a fourth pattern worth knowing even if you never sell in retail, because your customers will bring it to your inbox. Physical card tampering. Shoppers at both Woolworths and Coles have reported buying Apple gift cards that looked untouched but had already had their redemption codes recorded, including one Melbourne shopper who lost 3,300 dollars. Woolworths confirmed it introduced stronger in-store security measures and more secure gift card packaging in response. If you stock cards in a pop-up or through a stockist, the same exposure applies to you.
Layer 1: Break the Instant Delivery Window
Instant delivery is what makes gift card fraud profitable. Remove the instant, and most of it stops being worth the fraudster’s time. You are not trying to catch every bad order. You are trying to make your store slower than the next one on their list.
The control is a short, boring delay on high-risk gift card orders. Thirty minutes is enough. A genuine buyer sending a birthday voucher will not notice, especially if you tell them at checkout that the email arrives within the hour. A fraudster working through a list of stolen cards will not wait, because their window before the card gets reported is measured in minutes.
Tool recommendation: Shopify Flow. It is free on every plan from Basic upward and it does this properly. Here is the exact build.
- Install Shopify Flow from the app store, choose Create workflow, and select the trigger Order created.
- Add a condition: Order line items, product type equals Gift Card. Make sure this catches both your digital and physical gift card variants, because founders routinely miss one.
- Add a second condition group set to Any, containing your risk signals: order total over 250 AUD, billing country not equal to shipping country, customer created less than 30 minutes ago, and Shopify’s own fraud recommendation set to medium or high.
- On the true branch, add the actions Add order hold with the reason “Gift card review”, Add order tag of gift-card-review, and Send Slack message or internal email so a human actually sees it.
- Run it in test mode for a week against real orders before you turn it on, then check your held count. If you are holding more than 3 to 4 per cent of gift card orders, your thresholds are too tight.
Pair this with 3D Secure 2.0 on your payment gateway. When a transaction is authenticated through 3DS, liability for fraud-related chargebacks shifts to the card issuer rather than sitting with you. For a category as disputed as gift cards, that shift is worth the small amount of friction it adds.
Layer 2: Shut Down Code Enumeration Before It Finds Money
Enumeration is a volume game. Criminals use botnets to brute-force gift card codes and balance-check endpoints, testing thousands of combinations per second until they hit an active card with a balance on it. If your store gives a different response for a valid code than an invalid one, you have handed them a scoreboard.
Four controls close this down, and none of them require a developer.
- Do not publish a public balance checker. This is the most common self-inflicted wound in the category. If customers want their balance, make them log in to a customer account or reply to the original delivery email. A page that accepts a code and returns a balance with no authentication is a free oracle for bots.
- Never shorten your codes. Shopify generates long alphanumeric gift card codes for a reason. If you run an app that allows custom or vanity codes, keep those for named campaigns only, and never use sequential patterns like GIFT001 through GIFT500.
- Rate limit and challenge at the edge. Shopify’s built-in bot protection catches a lot, but if you are running a custom balance form or a headless front end, put Cloudflare Turnstile or your CDN bot rules in front of it. Cap attempts per IP and per session, and return the same generic message for both valid and invalid codes.
- Alert on failure volume, not just successes. A normal week might see a few dozen failed code entries. A thousand in an hour is an attack in progress. Set the threshold and get pinged.
If this pattern feels familiar, it should. It is the same infrastructure and often the same crews behind payment attacks, and the defensive playbook overlaps heavily. Our card testing defence playbook covers the edge configuration in more detail, and it is worth running both audits in the same sitting.
Layer 3: Put Hard Limits Into Checkout
Flow holds an order after it exists. Checkout rules stop the order existing at all. On Shopify Plus you can enforce these with Shopify Functions. On other plans you can get most of the way there with app-level limits and product settings.
These are the limits worth setting, in the order we usually implement them.
- Cap gift cards per order at three. Almost no legitimate customer needs eight vouchers in one transaction. Fraudsters buying in bulk absolutely do.
- Cap total gift card value per order and per customer per day. A ceiling of 500 AUD per order and 1,000 AUD per customer per 24 hours removes the high-value target without touching normal gifting behaviour.
- Block discount codes on gift card line items. If a 20 per cent off code applies to a gift card, you have built an arbitrage machine, and coupon extensions will find it within days. Exclude your gift card product from every automatic discount and every code.
- Do not let gift cards be bought with gift cards. This is how a fraudster splits one drained balance into a dozen clean small ones. Shopify blocks this by default. Check that no app has quietly re-enabled it.
- Require a customer account above a value threshold. One extra step, and it gives you something to correlate the next time the same actor comes back.
Set the numbers using your own data, not ours. Pull twelve months of gift card orders, look at the 95th percentile for order value and card count, and set your ceiling just above it. If your top 5 per cent of legitimate gift card buyers sit at 400 AUD, a 500 AUD cap costs you nothing at all.
Layer 4: Monitor Redemption, Not Just Purchase
Nearly every store watches the sale. Almost none watch the spend. That is backwards, because redemption is where the theft becomes visible and where you still have a chance to freeze a balance before it walks out the door.
Build a weekly review of four signals. Each one has a legitimate explanation some of the time, which is why you review them rather than auto-block them.
- Speed to full redemption. A card issued and drained to zero within minutes is the strongest single signal you have. Genuine recipients almost never spend a voucher in the same hour it arrives.
- Geography mismatch. Card purchased against an Australian billing address, redeemed against a shipping address in another country. Worth a phone call before you fulfil.
- Failed attempts before success. Three or more invalid code entries followed by a valid one, from the same session, means somebody guessed rather than received.
- Redemption on a card whose original order was later disputed. This is your true loss number. Tag it, total it monthly, and use it to justify the next control.
Shopify’s native fraud analysis gives you a starting risk score, but it was built to score the purchase, not the redemption. If your gift card volume is meaningful, a dedicated layer helps. NoFraud and Signifyd both offer chargeback guarantees on approved orders, which effectively transfers the risk. Chargeflow sits at the dispute end and automates representment. If you use a gift card app such as Gift Card Pro, switch on its Shopify fraud and risk integration so cards flagged as high risk are placed on hold rather than issued.
Whichever tool you pick, the rule is the same. Do not outsource the decision until you understand your own baseline. Run the manual weekly review for a month first, then buy the automation that replaces the work you now know needs doing. The same logic applies to disputes generally, which we broke down in the Shopify chargeback defence playbook.
Layer 5: Own the Liability Ledger
Here is the part almost nobody gets right, and it is a Protection issue and a Profit issue at the same time. Every unredeemed gift card on your store is a liability, not revenue. You have taken the cash and you still owe the goods. If you are booking gift card sales as revenue on the day of purchase, your P and L is telling you a story that is not true.
The Australian numbers make the point. The local gift card market was estimated at around 7.3 billion US dollars in 2024 and is forecast to reach 10.1 billion by 2028. Australian consumers are sitting on more than a billion dollars in unspent cards, with some surveys putting the figure closer to 1.4 billion. Breakage, meaning the portion never redeemed, has been estimated at about 3 per cent in the Australian market by the Australian Retailers Association, while industry analysts more commonly quote 6 to 7 per cent depending on segment and average transaction value.
Whatever your rate is, you need to know it, because two things depend on it. First, your real cash position. Second, your compliance position.
On compliance, Australian law is specific and it has teeth. Since 1 November 2019 every gift card sold or supplied to a consumer must carry a minimum three year expiry period, the expiry information has to be displayed prominently, and post-supply fees that reduce the card’s value are banned. Penalties reach 30,000 dollars for non-compliance, and each ACCC infringement notice runs at 55 penalty units, currently around 11,500 dollars for a body corporate. Telling a customer their voucher expired at twelve months, or that an admin fee applies, can also be treated as misleading conduct, which carries far larger penalties again.
Build the ledger as a single monthly sheet with five columns: issue cohort by quarter, value issued, value redeemed, value outstanding, and expiry date. Reconcile it against your Shopify gift card report and your accounting file every month end. Two things will fall out of it immediately. You will find cards you should have written off, and you will find cohorts approaching expiry that are worth a reactivation email while they are still legally live.
Layer 6: Write the 60 Minute Incident Runbook
The difference between a 500 dollar incident and a 15,000 dollar one is almost always response time. If an enumeration attack starts at 11pm on a Saturday and nobody looks until Monday, you have lost the whole weekend. Write the runbook now, while nothing is on fire, and store it where whoever is on call can find it in thirty seconds.
- Minute 0 to 5. Confirm and contain. Check the gift card report for redemptions in the last hour. If the pattern is real, disable the gift card product from the online store immediately. You can turn it back on in an hour.
- Minute 5 to 15. Freeze the balances. Deactivate every gift card issued in the attack window that has not been fully redeemed. Shopify lets you disable individual cards from the admin. Do this before you investigate why.
- Minute 15 to 30. Cut the source. Pull the offending IP ranges from your logs and block them at the CDN or edge. Turn on the strictest bot challenge you have. Enable your Flow hold rule if it was in draft.
- Minute 30 to 45. Protect the orders. Place a hold on every unfulfilled order paid wholly or partly with a card from the affected batch. Do not ship anything from that batch until you have checked it.
- Minute 45 to 60. Notify. Email affected genuine customers before they email you, reissue their cards, and log the total exposure. Then tell your payment provider, because early disclosure helps if disputes follow.
Test it once. Pick a quiet Tuesday, run a simulated incident with one real gift card, and time yourself. Most founders discover they cannot find the gift card report, do not know who has admin access to Cloudflare, or have no idea which orders used store credit. Better to learn that in a drill. Locking down who holds those keys is covered in the Shopify store lockdown playbook.
Why the Six Layers Compound
Each layer on its own is beatable. Together they change the economics of attacking your store, which is the only thing that actually matters.
A fraudster with a list of stolen cards hits the delivery delay and loses their speed advantage. A bot operator hits the rate limits and the silent responses and loses their scoreboard. A bulk buyer hits the checkout caps and loses the volume that makes the run worth doing. If any of them get through, redemption monitoring catches it inside a week instead of inside a quarter, and the runbook caps the damage at one hour instead of one weekend. Meanwhile the liability ledger means you always know exactly what you owe, so a bad month is a number you can act on rather than a surprise at year end.
None of this is expensive. Flow is free, the checkout caps are configuration, the ledger is a spreadsheet, and the runbook is an hour of writing. The only real cost is deciding to do it before something happens rather than after.
Your Gift Card Defence Checklist
Work through this in one sitting. Most stores can close the biggest gaps in an afternoon.
- Delivery delay. Flow rule live, holding high-risk gift card orders for 30 minutes, tested for a week, hold rate under 4 per cent.
- 3D Secure. Enabled on your gateway so authenticated transactions shift chargeback liability.
- Balance checker. No public, unauthenticated balance lookup anywhere on the site.
- Codes. Long, random, no sequential or vanity patterns outside named campaigns.
- Edge protection. Rate limits and a bot challenge on any custom gift card form, identical responses for valid and invalid codes.
- Checkout caps. Maximum three cards per order, value ceiling per order and per customer per day, set from your own 95th percentile.
- Discount exclusion. Gift cards excluded from every discount code and automatic discount, and not purchasable with store credit.
- Redemption review. Weekly check of speed to redemption, geography mismatch, failed attempts before success, and redemptions tied to disputed orders.
- Liability ledger. Monthly sheet by issue cohort, reconciled to your accounting file, breakage rate calculated.
- Compliance. Minimum three year expiry on every card, expiry displayed prominently, zero post-supply fees.
- Runbook. Written, stored where on-call can reach it, and drilled once with a real card.
Gift cards should be one of the best products you sell. High margin, instant delivery, no freight, and a built-in reason for someone new to visit your store. They only become a problem when you treat the money as banked and the code as harmless. Put the six layers in place and you keep the upside without funding somebody else’s weekend.
Inside eCommerce Circle, protecting the money you have already earned is one of the core pillars we work on with every member. If you want a second opinion on your gift card setup, let’s talk.
