Gift card draining on marketplaces: the balance is gone before the buyer spends it

Balance checking is the attack, not a prelude

Most teams watch for the spend. The damaging step happens earlier, when thousands of balance checks hit the gift card endpoint from rotating residential proxies. Each check is cheap and plausible on its own. In aggregate the pattern is unmistakable: sequential or near sequential card numbers, checks with no login, and a check rate no human redemption flow produces.

Rate limiting by IP address fails here for the usual reason. Residential proxy networks hand the bot a fresh address for nearly every request, so the limit never binds on any single source. The control that holds is velocity tied to the card range and to the device and session signals behind the check, plus a hard pause on a card after repeated failed PIN attempts.

A marketplace gift card sits across many sellers, categories, and checkout paths, which gives drained value plenty of places to land. The bot buys a popular, easily resold product, the seller ships in good faith, and the loss surfaces later when the real cardholder complains. Sorting out who absorbs that loss, platform, seller, or card issuer, is where these cases get expensive.

Why marketplaces are the soft target

Search and price comparison bots complicate the picture, and not every automated check is theft. Legitimate balance aggregators and a buyer's own repeated checks exist. The line is scale and sequence: enumeration across a number range is not shopping behaviour, and a defence that cannot say so will keep treating an attack as traffic.

Pull three fields together: time of first balance check, time of spend, and distance between the checking location signals and the spending ones. Drained cards compress all three. A card checked repeatedly in one hour and spent minutes later through an unrelated session is a different object from a card bought, held for weeks, and spent by its recipient.

What the redemption log should show you

Keep the check history, not just the transaction history. Platforms that log only successful redemptions throw away the evidence that distinguishes fraud from a disputed purchase. When a buyer says the balance was gone, the check log is the difference between an argument and an answer.

Require an account session for balance checks above a small number per hour, and step up to MFA when a check is followed quickly by a high value spend on a new device. Neither step blocks a recipient checking a balance once. Both steps break the economics of checking ten thousand cards an hour.

Delay is the underused tool. A short hold between a first time online spend and shipment on gift card funded orders gives the fraud signals time to arrive, and it is invisible to most buyers. Put the hold on the risk pattern, not on every gift card order, or you will punish the channel you are trying to protect.

Controls that cost honest buyers the least

Keep reading: How do bots stuff marketplace search with keyword spam listings?, How do fake coupon sites scrape marketplace deals and outrank the sellers?.

Frequently asked questions