Gift Card Fraud in 2026: The New Tactics Merchants Are Seeing (And How to Adapt)

What's Changed Since Our Last Fraud Playbook

Three months ago we published our gift card fraud prevention playbook, covering the six mechanics behind most gift card abuse: card testing, discount stacking, zero-amount probing, balance enumeration, refund laundering, and account takeover. Those have not gone anywhere. If you have not read it, start there, because everything below assumes it.

What has changed is how those attacks are executed and who they target. AI-generated content stopped being an emerging phishing trend and became the default, which quietly invalidated most of the "spot the bad grammar" advice merchants have given their staff for a decade. And two tactics our February post did not cover at all moved into the mainstream: executive impersonation aimed at your own employees, and order-level evasion patterns designed specifically to look boring to a risk engine. Here is what is new, including a fraud defense we shipped in late April.

The AI Phishing Arms Race Has Reached Gift Cards

KnowBe4's 2025 Phishing Threat Trends Report found that 82.6% of phishing emails now contain AI-generated content. IBM's research put numbers on why: generative tooling collapsed campaign build time from roughly 16 hours of human work to about 5 minutes. The same IBM data found 16% of 2025 breaches involved attacker use of AI, with phishing (37%) and deepfake impersonation (35%) the most common AI-enabled tactics.

Volume alone would be manageable. The problem is that the output is also better. A controlled human-subjects study by Heiding and colleagues, worth preferring over the eye-catching vendor numbers that circulate, measured a 54% click-through rate on AI-generated spear-phishing versus 12% for a generic baseline. That is not a marginal improvement. That is a four-fold increase in the odds that a member of your team acts on a fake message.

Microsoft's telemetry shows where this lands. Between January and March 2026 it detected roughly 8.3 billion email phishing threats, with business email compromise running at about 10.7 million attacks per quarter. QR-code phishing was the fastest-growing vector in the period, more than doubling in three months, which matters for gift card programs specifically: a scannable code in an email or on a printed card is exactly what recipients are already trained to trust.

The practical takeaway: retire "look for typos and awkward English" from your staff training. Verification has to be procedural, not intuitive.

New Tactic: "Gift Card BEC" and Why Your Own Team Is the Target

Our February post treated account takeover as a customer-side problem: someone drains a shopper's stored balance. The variant spreading now inverts that, and nobody touches your storefront at all. A fraudster impersonates your CEO over spoofed email or text and asks an employee to buy gift cards from other brands, typically Apple, Google Play, or Amazon, then send back the codes.

The FTC thought this common enough to issue a dedicated consumer alert in January titled "No, that's not your boss asking you to buy gift cards." A structural breakdown published in May lists seven repeating elements:

• An impersonated authority figure, usually the CEO or a direct manager
• A spoofed or lookalike sender address, or a text from an unknown number claiming to be a personal phone
• "Quick favor" framing that lowers the stakes of the ask
• Artificial urgency, often tied to a meeting or a client deadline
• A request for confidentiality, which is what prevents the employee from checking
• A specific brand and denomination, so the employee does not have to make decisions
• A handoff of the codes by email reply or photo of the scratch-off panel

The same analysis notes that the FBI's IC3 tracks thousands of these incidents per year, with average losses of $1,500 to $5,000 each. That is small next to wire-transfer BEC, and that is exactly the point: the amounts sit deliberately below most companies' purchase-approval thresholds, so nothing triggers a second signature. Microsoft's Q1 data shows gift-card-specific asks are still under 3% of BEC messages, but they dropped 37% in February and then jumped 108% in March. Small share, sharp swings, still being actively tested.

Merchants who sell gift cards carry extra exposure here for an unintuitive reason. Your staff already think about gift cards as an ordinary business object, so a request to go buy a few reads as routine rather than bizarre. That is the entire hurdle the scam has to clear.

New Tactic: Bundling Orders to Beat the Filters

The second genuinely new thing merchants are reporting is an evasion pattern rather than a new fraud mechanic. On the Shopify Community forums, a merchant described it precisely:

"I'm seeing a new pattern in my store where a digital gift card is purchased with a low value physical item to be sent. Nothing seems unusual but shortly after this order, a new order is placed by someone different for a physical product the same value using the gift card. No fraud detection was picked up on either order."

A reply in the same thread named the mechanism: the cheap physical item exists purely to give the order a shipping address and a normal-looking cart, and because the customer details match a genuine account, Shopify's fraud analysis often will not flag it. A separate thread on suspected fraudulent gift card orders describes the same shape independently.

Read that against our February coverage of card testing and balance enumeration and the evolution is clear. Those were mechanisms. This is a wrapper designed to make a mechanism invisible: the order is not anomalous in any single dimension, which is precisely what defeats a filter tuned to physical-goods fraud.

The frustration is real. From the second thread: "I am no longer going to offer gift cards in my Shopify store since thieves now have an outlet to try and scam us that way while we end up paying fees for bogus transactions that waste our time." That is a merchant walking away from a revenue line because the tooling did not keep up, which is a worse outcome than the fraud itself.

Regulators have noticed the broader trend. The FTC logged more than 41,000 fraud reports in 2024 representing $212 million in losses from scams involving gift and prepaid cards, and lawmakers in 22 states introduced more than 30 gift card fraud bills in 2025, up from 8 states and 12 bills the year before. The FTC also reported in May that imposter scams were the top reported category for the ninth consecutive year, with $3.5 billion in reported losses in 2025, up roughly 20% year over year. Our February post cited $217 million in gift card scam losses for 2023. The trend line has not reversed.

How GoGiftCards Is Fighting AI Fraud With AI of Its Own

In late April 2026 we shipped a phishing detection layer that did not exist when the February playbook was written. It addresses a question a security-conscious merchant should be asking in 2026: how do you know the gift card app you installed is not itself being used as a phishing delivery system? The "send as a gift" flow is an email pipeline with a trusted-looking template. Somebody was going to try to repurpose it.

So now, every time a merchant saves a gift card email template, the subject, headline, body, and salutation are screened by an AI classifier before the template can be used. It checks one thing: is this actually gifting content, or is it a fake job offer, a request for personal or financial details, an impersonation of a company or government agency, or urgency language that has nothing to do with a gift? The verdict is safe, suspicious (flagged for a human), or phishing.

When content is flagged as phishing, the system runs one more check before doing anything drastic: established business, or empty shell? A password-protected storefront is a strong signal on its own, since legitimate gift card merchants do not lock their storefront. So is the combination of one product or fewer, zero orders, and a store created in the last 14 days. If both signals fire, the store is blocked automatically. No gift card email goes out, the "Send as a Gift" button stops rendering, and the block is enforced independently at the API, the storefront config layer, and the order-processing job, so a stray webhook cannot slip one through.

Two design choices are worth naming. If the content looks like phishing but the store shows real signs of being a going concern, nothing is auto-blocked and a human reviews it, which keeps real merchants out of the blast radius. And if the check on store vitals fails, the system fails open rather than blocking on incomplete data.

This layer is additive, not a replacement. The risk-tiered engine, approval queue, and Risk Settings described in the original playbook still handle fraudulent purchases. This one handles fraudulent use of the send infrastructure itself, which is a different problem that only became urgent once generating convincing phishing copy got cheap.

Your Updated 2026 Fraud Checklist

These are additions to the February checklist, not replacements for it:

• Write down a verification protocol for internal gift card requests. Any ask from an executive to buy gift cards, over any channel, gets verified by calling a known number, never one supplied in the message. Codes never travel by email reply or photo. Tell your team plainly that no real executive will be annoyed by the callback.
• Treat "cheap physical item plus digital gift card in one cart" as a manual review trigger. Do not wait for a platform risk score to raise its hand. The pattern is specifically engineered to keep that score low.
• Stop teaching typos as a phishing tell. Assume every attempt your staff sees is polished, and train on structure instead: urgency, secrecy, an unusual payment instrument, a channel switch.
• Revisit Risk Settings on a schedule instead of setting them once. If you run seasonal gift card promotions, know what your discount review toggle is set to before the promo goes live, and set it back afterward.
• Keep balance-check and redemption endpoints rate-limited. Automated enumeration got cheaper to run at scale, and an endpoint too slow to be worth attacking in 2023 may not be now.
• Ask your app vendors about outbound abuse. When you next evaluate gift card apps on Shopify, ask how they stop their own send infrastructure from being used to phish your recipients. Most have no answer.

Gift card volume keeps growing, and as we noted alongside the 2026 gift card statistics, a growing market means a growing attack surface. The defenses just have to grow with it. Install GoGiftCards from the Shopify App Store to get risk-tiered order screening, an approval queue, real-time alerts, and the new phishing detection layer running on your store. The Basic plan starts at $4.99/mo with a 7-day free trial and no credit card required.