Gift Card Cracking: Bots That Guess Balance Codes

import { Image } from ‘astro:assets’;

Last Updated: March 2026

Your store sells gift cards. Customers buy them for birthdays, holidays, and corporate rewards. They sit in inboxes and wallets, loaded with value, waiting to be redeemed. And somewhere on the internet, a bot is systematically guessing every possible combination of card numbers and PINs to find the ones that hold a balance.

This isn’t hypothetical. Gift card cracking — also known as gift card enumeration — is one of the fastest-growing forms of ecommerce fraud. Attackers deploy automated scripts that hammer your balance-check page with millions of requests per hour, testing card number after card number until they find ones with money on them. Once they find a valid card with a balance, they drain it instantly — usually by purchasing digital goods that can be resold for cash.

The victim isn’t just the person who bought the gift card. It’s your store. You’re the one fielding angry support tickets. You’re the one issuing refunds. You’re the one dealing with chargebacks and the reputational damage that comes when customers learn their gift cards were emptied before they could use them.

And the scale of this problem is staggering.

The Anatomy of a Gift Card Cracking Attack

Gift card cracking works because of a fundamental weakness in how most gift card systems are designed: the balance-check endpoint is public, and card numbers follow predictable patterns.

How Card Numbers Become Vulnerable

Most retailers issue gift cards with standardized number formats. A 16-digit card number might share the same first 10 digits across every card in the program — the issuer prefix, the brand identifier, and the batch code. That leaves only 6 digits that actually vary between cards. Instead of having to guess from 10 quadrillion possible combinations (16 digits), an attacker only needs to cycle through one million possibilities (6 digits).

Add a 4-digit PIN, and you’ve got 10,000 additional combinations per card number. That sounds like a lot until you realize that a modern bot can test all 10,000 PIN combinations for a single card number in under 15 minutes when there’s no rate limiting in place. One security researcher demonstrated exactly this using a basic Python script — no sophisticated hacking tools required.

The Attack Lifecycle

Here’s how a typical gift card cracking operation works:

Step 1 — Reconnaissance. Attackers study your gift card number format. They might buy a few cards legitimately to examine the numbering structure, find patterns posted on forums, or purchase card number databases from the dark web. Physical reconnaissance is common too — walking through retail stores and photographing unactivated gift card racks to study the number sequences.

Step 2 — List Generation. Using the observed patterns, attackers generate a massive list of potential card numbers. If your cards use a 16-digit format where the first 10 digits are fixed, the attacker generates all one million possible remaining combinations.

Step 3 — Automated Enumeration. Bots submit each card number to your store’s balance-check page or API endpoint. Tools like OpenBullet, Snipr, and custom Python scripts automate this process across thousands of proxy IP addresses. The bot sends a balance-check request, reads the response, and records any card that returns a positive balance.

Step 4 — PIN Cracking. For cards that require PINs, the bot cycles through all possible PIN combinations for each card number that appears to be valid. Without rate limiting, this step is trivial.

Step 5 — Draining. Confirmed cards with balances are either used immediately for purchases on your store or other retailers that accept the same cards, sold in bulk on dark web marketplaces, or used to buy digital goods (game codes, streaming subscriptions, cryptocurrency) that can be easily resold.

The entire process — from reconnaissance to drain — can happen in hours. And it runs continuously, 24/7, without human intervention.

Real-World Attack Speeds

The numbers are sobering. The infamous GiftGhostBot attack in 2017 targeted nearly 1,000 ecommerce websites simultaneously, testing gift card numbers at a rate of 1.7 million per hour. At its peak, a single retailer received 4 million requests per hour — almost 10 times their normal traffic volume. And that was years ago. Modern bots are faster, more distributed, and harder to detect.

The Scale of Gift Card Fraud in 2025

Gift card fraud isn’t a niche problem. It’s a multi-billion-dollar industry that’s growing every year.

The FTC reported $12.5 billion in total fraud losses in 2024 — a 25% increase over 2023. Gift card fraud specifically accounted for $217 million in reported losses in 2023, and that figure only counts what victims actually reported. The real number is significantly higher.

Between 2018 and 2021, gift card fraud losses grew 364%. The trend hasn’t slowed down since.

Here’s what the current landscape looks like:

Metric	Value
Total US fraud losses (2024)	$12.5 billion
Gift card fraud losses (2023, reported)	$217 million
Growth in gift card fraud (2018–2021)	364%
US adults targeted by gift card scams	34% (1 in 3)
Retailers reporting increased gift card fraud	57%
Stolen retail gift cards on dark web (2025)	8.9 million
Average dark web gift card listings per month	30,173

The Dark Web Gift Card Economy

The stolen gift card market is thriving. Security firm Kasada identified 8.9 million stolen retail gift cards listed for sale on underground marketplaces ahead of the 2025 holiday season. Each month, an average of 30,173 retail gift card listings appear on criminal forums — a steady supply driven by automated cracking operations.

These aren’t just individual cards stolen one at a time. They’re the output of industrial-scale enumeration attacks that crack thousands of cards per day. Attackers list them at steep discounts — a $100 gift card might sell for $20–$40 — making the stolen card market attractive to buyers who use them for personal shopping or further fraud schemes.

Nation-State-Level Sophistication

The threat actors behind gift card fraud aren’t all amateur hackers. Microsoft’s May 2024 Cyber Signals report highlighted Storm-0539 (also known as Atlas Lion), a Morocco-based group whose tactics rival nation-state cyber operations. This group was stealing up to $100,000 per day from companies with gift card programs — not by cracking cards from the outside, but by compromising employee accounts through phishing, registering their own devices for persistent access, and generating fraudulent gift cards internally.

The sophistication is increasing across the board. Between April and September 2024, retailers faced over 560,000 AI-driven automated attacks per day. The tools are getting smarter, cheaper, and more accessible.

Why Shopify Stores Are Prime Targets

Shopify powers millions of stores worldwide, and that scale makes it an attractive target for gift card cracking bots. Here’s why:

Standardized Infrastructure

Many Shopify stores use similar or identical gift card implementations. The platform’s standardized architecture means a single attack script can work across hundreds of stores with minimal modification. An attacker who figures out how to crack gift cards on one Shopify store can often replicate the technique across many others.

Varying Security Maturity

While Shopify provides solid baseline security, many merchants — especially smaller stores — don’t implement additional protections like bot detection, rate limiting, or CAPTCHA on their gift card pages. The default configuration works well for legitimate traffic but offers limited resistance against automated enumeration.

API Exposure

Gift card balance-check functionality is often accessible through API endpoints that lack proper authentication or rate limiting. Bots can query these endpoints directly, bypassing any front-end protections entirely. API-level attacks are faster and harder to detect than browser-based ones because they skip the rendering overhead and send raw HTTP requests.

Seasonal Vulnerability

Gift card sales spike dramatically during holidays — BFCM, Christmas, Valentine’s Day, Mother’s Day. Attackers know this. They time their cracking operations to coincide with peak gift card seasons because more active cards mean more cards with balances to find. And during high-traffic periods, the increased volume of legitimate requests makes it easier for bot traffic to blend in unnoticed.

Limited Native Bot Protection

Shopify’s built-in bot protection features are primarily available to Shopify Plus merchants. Stores on standard plans have fewer native tools to detect and block automated traffic, making them more exposed to enumeration attacks.

The Damage Goes Beyond Lost Gift Card Balances

When bots crack your gift cards, the immediate financial loss is obvious. But the downstream effects are often worse.

Customer Trust Destruction

When a customer discovers their $100 gift card has been drained before they could use it, they don’t blame the attacker — they blame your store. It doesn’t matter that you didn’t personally steal the money. The gift card had your brand on it. The purchase happened on your platform. In their eyes, you failed to protect their money.

Research shows that 61% of consumers won’t buy from a site they perceive as insecure. A single gift card fraud incident, especially if it reaches social media or review platforms, can damage customer confidence far beyond the value of the stolen cards.

Support Cost Explosion

Every compromised gift card generates support tickets. The customer contacts you to report the issue. Your team investigates. You issue a replacement or refund. You update your records. The average cost of a customer support interaction ranges from $5 to $25 depending on channel and complexity. If bots crack 50 cards in a single attack, you’re looking at $250 to $1,250 in support costs alone — before accounting for the refunds themselves.

Chargeback Risk

If gift cards were purchased with credit cards, compromised cards can trigger chargebacks. The original purchaser disputes the charge because the gift card they bought was worthless by the time the recipient tried to use it. Each chargeback costs $15 to $100 in fees, plus the value of the card, plus the operational cost of responding to the dispute.

Inventory and Fulfillment Chaos

When attackers use cracked gift cards to place orders on your store, those orders consume real inventory. If the fraud isn’t caught before fulfillment, you ship products that were paid for with stolen gift card balances — products you’ll never be compensated for. If it is caught, you’re canceling orders and restocking items, which creates fulfillment disruptions.

SEO and Analytics Pollution

Gift card cracking bots generate enormous volumes of requests to your balance-check pages. This bot traffic inflates your page views, distorts your bounce rate, skews your geographic analytics, and wastes your server resources. If the traffic volume is significant enough, it can slow your site down — directly impacting your Core Web Vitals scores and search engine rankings.

How to Protect Your Shopify Store from Gift Card Cracking

Prevention is infinitely better than remediation. Here’s a layered approach to protecting your store.

Layer 1: Bot Detection and Blocking

The most effective defense against gift card cracking is stopping bots before they reach your balance-check page. If automated traffic can’t access your site, it can’t enumerate your cards.

Kedra Shield provides comprehensive bot detection for Shopify stores. It identifies automated visitors using behavioral analysis, device fingerprinting, and traffic pattern recognition — blocking bots while allowing legitimate customers through.

Here’s why bot-level protection matters more than endpoint-level fixes:

Proactive vs. reactive. Rate limiting on your balance-check page only kicks in after the bot has already started probing. Bot detection stops the attacker at the door.
Comprehensive coverage. Gift card cracking bots don’t just hit the balance-check page. They also probe your APIs, test checkout flows with stolen card numbers, and scrape your site for information. Blocking the bot blocks all of these behaviors simultaneously.
Adaptive protection. Sophisticated bots rotate IP addresses, user agents, and behavioral patterns to evade simple rules. Advanced bot detection uses machine learning to identify these evasion tactics and adapt in real time.

Traditional WAFs (Web Application Firewalls) catch as little as 11% of bot traffic according to recent testing. Dedicated bot detection solutions are significantly more effective because they’re purpose-built for the problem.

Layer 2: Rate Limiting and Velocity Controls

Even with bot detection in place, implement rate limiting on your gift card balance-check endpoints as a second line of defense:

Per-IP limits. Restrict balance-check requests to 3–5 per minute per IP address. Legitimate customers check one or two cards. Bots check thousands.
Per-session limits. Limit balance checks per browser session to prevent bots that rotate IP addresses but maintain the same session.
Per-device limits. Use device fingerprinting to enforce limits even when IPs and sessions change. This catches bots that use residential proxy networks to appear as different users.
Global velocity alerts. Set thresholds for total balance-check requests across your store. If the volume spikes beyond normal levels, trigger alerts and temporarily increase protection.

Layer 3: CAPTCHA and Challenge-Response

Adding CAPTCHA to your gift card balance-check page forces manual interaction. A human checking their gift card balance can solve a CAPTCHA in seconds. A bot testing millions of combinations is stopped cold — or at least slowed to a crawl.

Progressive challenges work best: start with invisible challenges that don’t affect legitimate users, and escalate to visible CAPTCHAs when suspicious patterns are detected.

Layer 4: Card Design Improvements

Work with your gift card provider to improve card security:

Longer, truly random numbers. Move beyond predictable number formats. Use 19-digit card numbers with no discernible pattern between cards.
Longer PINs. A 6-digit PIN has one million possible combinations versus 10,000 for a 4-digit PIN. That’s a 100x increase in brute-force difficulty.
Alphanumeric codes. Including letters in card numbers and PINs dramatically increases the keyspace. A 6-character alphanumeric PIN has over 2 billion possible combinations.
Lockout after failed attempts. Lock a card after 3–5 consecutive failed PIN attempts and require manual verification to unlock it.

Layer 5: Monitoring and Alerting

Set up monitoring to detect cracking attempts early:

Balance-check endpoint monitoring. Track request volumes to your gift card balance-check page. A sudden spike — especially from new or unusual traffic sources — is a strong signal of an enumeration attack.
Geographic anomalies. If your customers are primarily in North America but you see a surge of balance-check requests from data centers in Eastern Europe or Southeast Asia, investigate immediately.
User-agent analysis. Bot traffic often uses outdated, unusual, or mismatched user-agent strings. Monitor for patterns that don’t match legitimate browser traffic.
Failed lookup tracking. A high ratio of failed balance checks to successful ones indicates enumeration. Legitimate customers usually check one card successfully. Bots generate hundreds of failures for every success.

Layer 6: VPN and Proxy Detection

Gift card cracking operations almost always route traffic through VPNs, proxies, or residential proxy networks to avoid IP-based detection. Identifying and flagging traffic from these sources adds another layer of protection.

Kedra Shield includes VPN and proxy detection capabilities that identify traffic originating from known anonymization services. This doesn’t mean blocking all VPN users — some legitimate customers use VPNs for privacy. But flagging this traffic for additional scrutiny (like requiring CAPTCHA completion) raises the bar for attackers significantly.

What Makes Modern Gift Card Bots So Dangerous

The bots targeting your store today are nothing like the simple scripts of five years ago. Understanding their capabilities helps you appreciate why layered protection is essential.

Residential Proxy Networks

Modern bots route traffic through residential proxy networks — real home internet connections that have been compromised or rented out. This means bot traffic appears to come from legitimate residential IP addresses in your target market. Traditional IP-based blocking is ineffective because you can’t distinguish a bot using a residential proxy in Ohio from a real customer in Ohio based on IP alone.

Behavioral Mimicry

Advanced bots mimic human behavior patterns. They move a virtual mouse cursor, scroll pages, pause between requests at human-like intervals, and execute JavaScript. Simple bot detection methods that look for missing JavaScript execution or perfectly timed requests miss these sophisticated operators entirely.

Distributed Architecture

Instead of hammering your site from a single IP address (which is easy to detect and block), modern bots distribute requests across thousands of IP addresses. Each individual IP might only make one or two requests — well within normal limits — but the combined operation is testing thousands of card numbers per minute.

AI-Enhanced Attacks

The latest generation of bots uses artificial intelligence to adapt in real time. When one approach is blocked, the bot adjusts its behavior, headers, timing, and routing to find a new path through your defenses. This cat-and-mouse dynamic means static security rules alone aren’t enough — you need adaptive protection that evolves as fast as the threats do.

Industry-Specific Considerations

Different types of Shopify stores face different gift card cracking risks.

High-Volume Retail Stores

If you sell gift cards in high volumes — especially during holidays — you’re a prime target. The more active cards in circulation, the more likely a random card number will return a positive balance. Focus on bot detection and rate limiting at scale.

Digital Product Stores

Stores selling digital products (game keys, software licenses, digital downloads) are especially attractive for gift card fraud because the attacker can drain a cracked card and receive the product instantly — no shipping address required, no fulfillment delay, and much harder to reverse.

B2B and Corporate Gift Card Programs

Corporate gift card programs often issue cards in sequential batches with high balances. This makes them particularly vulnerable to enumeration because the number patterns are even more predictable and the payoff per successful crack is higher.

Subscription-Based Stores

If your store accepts gift cards for subscription payments, cracked cards can be used to set up subscriptions that drain the balance over multiple billing cycles. Monitor gift card-funded subscriptions for unusual patterns.

Building a Gift Card Security Audit Checklist

Use this checklist to evaluate your store’s current protection level:

Card Infrastructure

Card numbers use 19+ digits with no predictable prefix patterns
PINs are 6+ digits or alphanumeric
Cards lock after 3–5 failed balance-check attempts
Card numbers are generated with cryptographic randomness

Endpoint Protection

Balance-check page has rate limiting (3–5 requests per minute per IP)
CAPTCHA or challenge-response is implemented
API endpoints require authentication or are not publicly accessible
Failed balance-check attempts are logged and monitored

Bot Detection

Dedicated bot detection solution is installed (e.g., Kedra Shield)
VPN and proxy traffic is flagged for additional scrutiny
Traffic from data center IP ranges is blocked or challenged
Behavioral analysis is active to catch sophisticated bots

Monitoring

Balance-check request volumes are tracked with alerting thresholds
Geographic distribution of balance-check requests is monitored
Failed-to-successful check ratio is tracked
Unusual user-agent patterns trigger investigation

Response Plan

Incident response procedure is documented for gift card attacks
Customer communication templates are prepared for compromised cards
Refund and replacement process is defined
Escalation path to payment provider is established

Common Questions About Gift Card Cracking

How do I know if my store is being targeted?

The most obvious sign is a sudden spike in traffic to your gift card balance-check page. Check your server logs or analytics for unusual patterns: high request volumes from new geographic regions, requests with missing or unusual user agents, or a high ratio of failed balance checks to successful ones. If you’re seeing hundreds or thousands of balance-check requests per hour when your normal volume is a few dozen, you’re likely under attack.

Can attackers crack gift cards without a balance-check page?

Yes, but it’s harder. Some attackers attempt to use cracked card numbers directly at checkout rather than checking balances first. This approach is less efficient because they don’t know which cards have balances, but it still works at scale. Protecting your checkout flow is as important as protecting your balance-check endpoint.

Should I remove my gift card balance-check feature entirely?

No — that would hurt the customer experience. Legitimate customers need to check their balances. Instead, protect the feature with rate limiting, CAPTCHA, and bot detection. The goal is to make the endpoint usable for humans but impractical for bots.

What should I do if gift cards have already been compromised?

First, deactivate any cards you believe have been compromised. Second, investigate the attack to understand the scope — how many cards were affected, what the total exposure is, and how the attacker accessed the balance-check endpoint. Third, issue replacement cards to affected customers with a clear explanation and apology. Fourth, implement the protection layers described above before the attacker returns. They almost always do.

How much does gift card fraud actually cost per incident?

Beyond the face value of stolen card balances, factor in support costs ($5–$25 per ticket), chargeback fees ($15–$100 per dispute), replacement card costs, fulfillment losses from fraudulent orders, and reputational damage. A single attack that compromises 100 cards with an average balance of $50 could easily cost $10,000–$20,000 in total impact.

Are virtual gift cards more vulnerable than physical ones?

Virtual gift cards are generally more vulnerable because the entire lifecycle — purchase, delivery, and redemption — happens digitally. There’s no physical card to protect, no PIN scratch-off to conceal, and the card number and PIN are typically sent via email, which can be intercepted. Physical cards have the additional protection of requiring physical access to read the number and PIN (though attackers do compromise physical cards by tampering with them in stores).

Taking Action: Protect Your Gift Cards Now

Gift card cracking is not a theoretical risk. It’s happening right now, at scale, targeting Shopify stores of all sizes. The tools are cheap, the techniques are well-documented, and the attackers are relentless.

The good news is that protection is achievable. A layered approach combining bot detection, rate limiting, card design improvements, and monitoring can make your store an extremely hard target. Most attackers follow the path of least resistance — if your store has meaningful protection in place, they’ll move on to easier targets.

Here’s your immediate action plan:

Audit your current exposure. Check your balance-check page traffic for signs of bot activity. Review your gift card number format for predictable patterns.
Install bot protection. Kedra Shield provides automated bot detection that identifies and blocks gift card enumeration bots before they can test your cards. It works quietly in the background, protecting your store without affecting the experience for legitimate customers.
Implement rate limiting. If your platform or hosting allows it, add rate limits to your balance-check endpoint. Even basic limits (5 requests per minute per IP) dramatically slow down enumeration attacks.
Add CAPTCHA to balance checks. Require CAPTCHA completion before showing gift card balances. This single step blocks the vast majority of automated cracking attempts.
Monitor continuously. Set up alerts for unusual balance-check activity. The sooner you detect an attack, the fewer cards get compromised.
Review your card design. Talk to your gift card provider about longer numbers, stronger PINs, and lockout policies. These structural improvements raise the difficulty of cracking exponentially.

Your gift cards represent real money — your customers’ money. Protecting that value isn’t just good security practice. It’s a fundamental part of the trust relationship between your store and the people who shop there. When a customer buys a gift card from you, they’re trusting you to hold that value safely until it’s redeemed. Bot protection ensures you can deliver on that promise.

Don’t wait for an attack to reveal the gaps in your protection. By then, the damage is done. Take action today, and make your store one that the bots skip over in search of easier prey.