# How do gift card draining bots empty marketplace balances before owners notice? | BazaarFort

Source: https://bazaarfort.com/blog/2026-10-19-gift-card-draining-bots-marketplaces.html

[Home](../index.md) / [Blog](index.md)


October 19, 2026 - BazaarFort

**Short answer:** Bots treat gift cards like cash with a combination lock that can be guessed by software. They test numbers and PINs in bulk, record which cards hold value, and drain the live ones through quick purchases or resale before the owner ever opens the wallet page.

## A gift card number is a bearer instrument

Anyone who holds the full card number and PIN can usually spend the balance, with no name check and no second factor. That design makes gift cards easy to give and easy to steal. A leaked or guessed credential is the whole account, and the spend leaves almost no identity trail for investigators to follow afterward.

Cards sold through marketplaces carry extra risk because numbers pass through more systems: the issuer, the marketplace listing, the delivery email, and the buyer inbox. Each handoff is a place where a number can be copied without the physical card ever changing hands.

## Draining starts with silent balance checking

Attackers first test large batches of number and PIN combinations against balance check endpoints, often using numbers harvested from breaches, phishing, or brute force patterns in sequential card ranges. Most checks fail quietly. The ones that return a balance are the inventory for the next step, ranked by value.

Balance checking looks harmless in logs, which is why it works. A single check is what a real owner does before shopping. Ten thousand checks an hour from rotating networks, with a steady hit rate on live cards, is a harvesting operation that should trigger rate limits and challenges.

## The drain itself is fast and deliberately ordinary

Once a live balance is found, the value moves quickly. Bots buy popular, resalable goods, convert balances into other gift cards, or sell the working number at a discount to a buyer who spends it within the day. Speed matters because the real owner or the issuer may freeze the card once fraud is reported.

The purchases are chosen to look normal: common products, standard shipping, no exotic basket. The abnormal part is timing and clustering, many unrelated cards spent in similar patterns from similar sessions, which is visible only when someone joins the data across orders.

## Why owners discover the loss too late

Most people check a gift card balance when they try to spend it, which may be months after it was given. By then the drain is old, logs are harder to pull, and the goods bought with the balance are long delivered or resold. The delay is part of the business model, not an accident.

Marketplaces then face a proof problem. The owner says the balance was stolen. The records show a valid number and PIN used correctly. Without balance check logs and session data, the platform cannot easily tell a draining bot from a forgetful owner who spent the card and forgot.

## Defenses that make draining expensive

Rate limit and challenge balance checks, require the PIN only through protected flows, and alert the purchaser when a balance is first checked from a new network or spent in full. Partial redemption patterns and sudden full drains should both raise review flags before goods ship.

For sellers, the practical steps are narrower: buy card stock only from issuers, never store full numbers and PINs together in plain systems, and reconcile sold card balances against redemptions weekly. A card that redeems before it is delivered is a leak you can still trace if you look quickly.

Keep reading: [How do price scraping bots help rival sellers undercut you within minutes?](https://bazaarfort.com/blog/2026-10-19-price-scraping-bots-marketplaces.md), [How do fake reviews get manufactured and planted on marketplace listings?](https://bazaarfort.com/blog/2026-10-19-fake-reviews-marketplaces.md), and [How do fake seller accounts flood marketplaces with counterfeit listings?](https://bazaarfort.com/blog/2026-10-17-fake-seller-accounts-counterfeit-listings.md) cover the nearby cases in this series.

## Frequently asked questions

### How do bots get gift card numbers and PINs?

From breaches, phishing pages that mimic balance check sites, sequential guessing within known card ranges, and leaks inside resale supply chains. They then test the combinations in bulk against balance check tools to find which cards hold value.

### Why is gift card draining hard to reverse?

Because a valid number and PIN spend looks legitimate in the records, the goods are usually resalable and move fast, and owners often discover the loss months later. That combination makes chargeback style recovery rare.

### What is the clearest sign of a draining operation?

Volume and rhythm in balance checks: thousands of checks from rotating networks, a steady share returning live balances, followed by rapid full balance spends in similar baskets. One check is a shopper. A metronome is a harvest.

### What should a marketplace do first?

Put rate limits and challenges on balance checking, alert buyers on first check and full redemption, and hold shipment briefly on high risk drains. Checking is where the operation is cheapest to disrupt.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@bazaarfort.com?subject=Free%20free%20bot-traffic%20audit)