In February 2017, Distil Networks watched a bot it named GiftGhostBot test gift card numbers at a rate of 1.7 million per hour. The targets were luxury retailers, supermarkets, and major coffee chains, any store with a gift card balance lookup on its site. On one customer website, analysts recorded 4 million bad bot requests per hour, nearly ten times the normal level of traffic. The bot was distributed across worldwide hosting providers, mobile ISPs, and data centers, executing JavaScript to avoid detection, rotating user-agent strings, and persisting for weeks. The attack has not gone away since. It has become the standard shape of gift card fraud, and the balance lookup is still the weak point, because it has to be public, fast, and open to customers with no account and no login.
The attack is called enumeration, or cracking. Bots run large batches of card-number and PIN combinations against the balance check or checkout, find the cards with a live balance, and drain or resell them. The economics favor the attacker until you change them. One request costs almost nothing, and a single drained card can pay for millions of attempts. In 2024, consumers filed 41,120 fraud reports to the FTC where a gift card or reload card was the payment method, adding up to 212 million dollars in losses. That is the reported slice. The unreported slice is the recipient who discovers an empty card at a till, in front of a queue, and blames the brand, not the bot.
Bot enumeration rarely looks like human checking. Humans check one card, mistype once, and stop. Scripts check many distinct card numbers from one session, device, or network, at regular intervals, with a very low success rate, and they often ignore images and other page assets. Logging distinct card numbers per session and per network is the single most useful detection signal. Other tells stack on top of it: balance checks with no other browsing, repeated checks at exact intervals through the night, and user agents that claim to be common browsers but fail basic consistency checks. None of these proves fraud alone. Together they describe a machine doing arithmetic, not a customer checking a gift.
Defense aims to raise the cost per attempt and lower the value of a success. Rate limits tied to behavior, not just to IP, because the bot rotates addresses. Challenges that rise with risk, so a single check sails through and the thousandth check in an hour does not. Alerts that freeze a card when its balance is queried in an unusual pattern. And card design that never relies on a short, guessable number alone: long, random card numbers plus a separate PIN or scratch panel value make brute force far less practical, because the attacker must guess a pair, not a sequence. At redemption, require the same pair, monitor velocity per card, and alert on balance checks from distant locations in quick succession.
When an attack is found, act on evidence. Block the abusive sessions and networks, step up challenges on the lookup, and identify cards whose balances were checked in the attack window. Freezing every card in a range punishes customers for your incident. Targeted holds on demonstrably probed cards, with a fast replacement route for the real owners, contain loss without a public relations problem. The physical side needs the same discipline. Card draining starts on the rack: criminals copy numbers from cards on store displays, reseal the packaging, and drain the funds minutes after a shopper loads them. Homeland Security Investigations calls it Project Red Hook and links the schemes to organized crime groups with losses in the hundreds of millions of dollars. Tamper-evident packaging, concealed PINs, and staff checks of card displays are the countermeasure there. Digital cards bought directly from the retailer's own website bypass the rack entirely, which is the simplest advice to give a customer who asks how to buy safely. Check balances only through the brand's verified website, and treat any third-party balance checker as a phishing site until proven otherwise.
Keep reading: The FTC Fake Review Rule, Two Years In: What It Bans and What It Has Done, Credential Stuffing: Your Old Password Is the Attack, and The FTC Click-to-Cancel Rule Is Dead. The Obligations Are Not cover the nearby cases in this series.
Enumeration, also called cracking, is when bots test large batches of card numbers and PINs against a balance lookup or checkout to find cards with a live balance, then drain or resell them. GiftGhostBot, tracked by Distil Networks in 2017, tested 1.7 million gift card numbers per hour.
In 2024, consumers filed 41,120 fraud reports to the FTC where a gift card or reload card was the payment method, adding up to 212 million dollars in reported losses. Homeland Security Investigations links organized draining rings to losses in the hundreds of millions of dollars.
The single most useful signal is distinct card numbers checked per session and per network. Humans check one card and stop. Scripts check many distinct numbers at regular intervals with a very low success rate, often ignoring images and page assets, and often at exact intervals through the night.
Long, random card numbers plus a separate PIN or scratch panel value, so the attacker must guess a pair rather than a sequence. Add behavior-based rate limits, challenges that rise with risk, velocity monitoring per card, and alerts on balance checks from distant locations in quick succession.