# How do gift-card balance-draining bots strip marketplace gift cards? | BazaarFort

Source: https://bazaarfort.com/blog/2026-10-13-gift-card-balance-draining-bots-marketplaces.html

[Home](../index.md) / [Blog](index.md)


October 13, 2026 - BazaarFort

**Short answer:** Draining bots enumerate gift card numbers and PINs, validate them against balance-check endpoints, and spend or resell live balances within minutes, long before the real buyer tries to redeem the card.

## Why gift cards are a perfect bot target

A gift card is bearer money. Whoever presents a valid number and PIN can spend the balance, and marketplaces make balance checks deliberately easy so real buyers can confirm what a card is worth before checkout. That convenience is the vulnerability. Bots treat the balance checker as a free validation oracle: feed it candidate numbers, keep the ones that answer with a live balance, discard the rest.

The numbers themselves come from everywhere. Some are generated by brute force against predictable numbering ranges. Others are harvested from phishing pages, leaked databases, photos of cards posted on social media, and malware that scrapes receipts. A card bought in a store on Monday can be drained by Friday without the plastic ever leaving the buyer's wallet.

## How a draining run actually works

The run starts with enumeration. Bots cycle through number ranges at low speed, rotating residential proxies so each IP address only makes a handful of checks. Speed is the enemy here: fast checks get blocked, so draining operations are patient, spreading millions of guesses across days. Every hit gets logged with its balance.

Cash-out follows immediately. Live balances are spent on easily resold goods, converted into other gift cards, or sold at a discount on secondary markets within minutes of discovery. Speed matters because the first spender wins: once the balance hits zero, the legitimate owner's claim becomes a customer service problem, not a recoverable asset.

## Signals your marketplace is being enumerated

Balance-check traffic is the tell. Look for check volumes that spike outside shopping hours, high ratios of invalid to valid numbers from the same device fingerprints, and checks that never convert into a cart or a login. A real buyer checks one or two cards. An enumerator checks thousands and buys nothing until a hit appears.

Redemption patterns confirm it. Cards drained within days of activation, balances spent in a different region from where the card was sold, and clusters of cards from the same retail batch emptied in sequence all point to enumeration rather than ordinary fraud. Your support queue sees it first, as buyers report zero balances on cards they never used.

## Defenses that raise the cost of draining

Rate-limit balance checks per device and per card, not just per IP, and require a CAPTCHA or login after a small number of anonymous checks. Mask balances behind partial responses: confirm a card is active without printing the exact amount until the holder authenticates. Every extra step multiplies the attacker's infrastructure cost.

On the card side, use longer random numbers with no sequential batches, require PIN scratch-off plus online activation delays for high denominations, and alert on first-redemption geography that mismatches the sale location. None of this stops a determined ring, but draining is an economics game: make enumeration slow and noisy enough and the bots move to a softer marketplace.

## Frequently asked questions

### How do bots get gift card numbers in the first place?

They generate candidates from predictable numbering ranges, harvest numbers from phishing pages and leaked data, and scrape photos or receipts where buyers exposed the card details. The balance checker then tells them which numbers are live.

### Why do drained cards show a zero balance when the buyer never used them?

Because the bot spent the balance first. Gift cards are bearer instruments, so the marketplace honors whoever presents valid credentials first, and draining operations cash out within minutes of finding a live balance.

### What is the fastest defense a marketplace can add?

Rate limits and step-up challenges on the balance-check endpoint. Requiring a login or CAPTCHA after a few anonymous checks breaks the free validation loop that enumeration depends on.

### Can a buyer recover a drained gift card balance?

Often yes through customer support, if the marketplace can see the redemption was fraudulent. Recovery is manual and slow, which is why preventing enumeration beats refunding victims after the fact.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bazaarfort.com?subject=Free%20free%20bot-traffic%20audit)