This time, Cofense analysts purchased $500 worth of trackable gift cards to intentionally give to scammers in the hopes of discovering what happens once scammers receive these funds. With gift cards continuing to be one of the more difficult cash-out methods to track, due to the complexity and locality of the information, we had no idea what we would find.
In all but one case, each gift card was stolen, re-sold, and used for purchases within 24 hours. And while scammers do have preferences for the brand of cards they target, they are willing to pivot depending on the cards available. Based on the research, scammers prefer to use in-store cards over credit card gift cards.
Based on empirical evidence captured by defenders around the world, we know that once gift cards are stolen, they are sold locally or remotely via gift card exchanges. For gift cards sold remotely, many appear to be sold on cryptocurrency exchanges, where cards can be sold for Bitcoin, Ethereum, or other forms of digital payments. While many of the remotely sold gift cards are exchanged for 80-85% of the face value, cards can be purchased locally for around 50% of the face value, depending on the country. While a fuller picture of how gift card fraud works are limited to the organizations and institutions who manage this infrastructure, we do know current losses are in the hundreds of millions of dollars.
Traditionally, Business Email Compromise (BEC) is straight forward. In these attacks, a scammer impersonates a C-level executive within the company to convince unsuspecting users to make urgent wire transfers to vendors, organizations, and other accounts that they control. As awareness of this tactic grew, organizations adapted and increased their diligence against these types of attacks. Attackers took notice and started to adjust their attack methods to include payroll diversion, invoice fraud, check fraud, and the topic of this research: gift cards.
Once the unsuspecting victim has taken the bait and responded to the scammer, they will be asked to go to a local store to purchase gift cards, often in $100 or $500 dollar denominations. After the cards have been purchased, the scammers ask the victims to scratch off the back code and send them pictures of the cards. Once received, the scammers confirm receipt and push the victim to send more cards or money over time.
While we focus on one small piece of gift card fraud, we acknowledge that there are many other areas of gift card fraud that are not fully understood. We know cryptocurrency theft, re-shipping scams, in-person purchases, and many other angles of gift card fraud exist. In addition, a fuller scope view of how gift card fraud works is held with card distributors and brokers, and more extensive collaboration is necessary in order to facilitate a better understanding of the gift card ecosystem.
In the initial phish, Ian asked if we could do something for them right away. Ian was in a meeting with limited connectivity and asked if we could purchase 5 Steam gift cards, an online platform for purchasing video games, for a total of $1,000 (5x$200). To set up the bait, we told Ian that Visa cards were the only ones we could purchase and asked if we could use those instead of the requested Steam gift cards. Ian confirmed, and we provided a single $25 dollar gift card. Ian kept asking if there was something wrong with the transaction as they were expecting multiple cards, however we only provided one gift card in this engagement. The total interaction and engagement lasted two days.
For the gift card in this transaction, unknown persons purchased $25 worth of products with GivingLi, a greetings and gift card company. While we do not have visibility into the product or good that was purchased, historically we have seen Yahoo Boys and other scammers sending cards and flowers to romance victims to keep them in the scheme for longer periods.
One of the interesting things we noticed is that we purchased the gift cards prior to the engagement and the scammer was quick to identify this discrepancy, however we just said that the credit card machines were giving the incorrect dates on the receipts, and this was enough for the scammer to accept the difference.
While most scammers assume one persona during an engagement, this scammer went through four different names for the entirety of the campaign. John Slattery, Jerry Williams, Roger Jenkins, and Stephen Timm all asked about gift cards in the same exact thread. This commonly happens when scammers get confused and use different display names during engagements, as they will sometimes engage with multiple companies per account. In addition, the scammer used six different subject lines during this engagement.
And as counter intuitive as it may sound, it was especially difficult to convince scammers to take the gift cards that we had. They had pre-defined scripts in $100 dollar denominations, and if something deviated out of that it really seemed to throw them for a loop. In addition, timing of the receipts was also another metric that scammers looked for, and if something was outside the scope of the normal time frame scammers were very hesitant to use them.
You can sell digital gift cards for Amazon and almost any other store or restaurant. All you need to do is enter the gift card serial number and Raise will verify the remaining balance before the listing goes live.
With your Amazon gift card money, you can not buy other Amazon gift cards, but you can buy select third-party gift cards for other stores. The funds from the gift card can not be transferred to other Amazon accounts or exchanged for cash.
The second option is to place your desired items in your Amazon cart, proceed to the checkout page, and redeem your gift card there. If the value of your items exceeds the value of your gift card, the difference will be charged to your default payment method.
The Amazon app can be used to redeem gift cards if you have an iPhone, iPad, or Android phone. You also have the option of scanning your gift card instead of manually inputting the code with this technique. To start:
One of the best ways to get rid of unused gift cards is to take them to your local gift card exchange kiosk and swap them for cash. A gift card kiosk allows you to turn physical gift cards into real money that you can spend or save.
A gift card exchange kiosk is a physical machine that allows you to turn unwanted gift cards into instant cash. You can insert your card, get a quote for instant cash and accept or decline their offer.
In terms of their physical appearance, gift card kiosks can look like stand-alone ATMs, DVD rental machines, photo booths or even a slot machine. These self-service machines can be located in a plethora of grocery stores, drugstores and retail stores like Target or Walmart.
There are also online gift card exchange kiosks that you can use to turn gift cards into easy money. This can be a great option if you want to sell physical or digital (e-gift) cards for cash.
GiftCardBin allows you to exchange unwanted gift cards for cash locally through its network of partner locations. There are more than 600 partner locations across the United States, so this could be one of the best places to exchange gift cards for cash.
Walgreens locations may have gift card exchange kiosks where you can turn different gift card options into cash. You may also be able to return a Walgreens gift card for cash if you have the original receipt.
You can list your unwanted gift cards on Raise and earn up to 85% cashback when they sell. Raise pays you via direct deposit, paper check or transfer to a PayPal account, which makes it simple to collect your cash.
Gift Card Outlets (formerly Gift Card Spread or GC Spread) is an online marketplace where you can sell unwanted gift cards at your own price. This means you have more control when it comes to selling gift cards for cash.
The only hitch is that payments are only made by check and it can take up to 10 days to receive payment. So if you need instant cash for your gift cards, you may want to explore one of the other online gift card exchange kiosk options mentioned here.
ClipKard makes it as easy as possible to sell gift cards for cash online. You can add your card, review your cash offer, ship in your physical cards and get paid. You can also earn reward points for each gift card you sell which you can then use to buy gift cards at a discounted rate.
For example, if you have a Sephora gift card you could use it to purchase beauty products and then flip them on Facebook Marketplace or eBay. Or you could purchase items with a gift card, then sell them to a pawn shop for fast cash.
When donating gift cards to charity, consider whether the charity will be able to use them. Amazon gift cards, for example, can be used to buy a wide range of things. But if you have gift cards to a grocery store or a pet store, you might need to find a charity that specializes in meeting those kinds of needs to donate them to.
Comparing gift card exchange kiosks near you can help you figure out which ones offer the most money for unused gift cards. You could also try selling gift cards to friends or family members at a discount, which would allow you to bypass any fees you might pay at an exchange kiosk.
There are lots of ways to get free gift cards that you can trade for cash at a gift card exchange kiosk. Some of the best places to get free gift cards for doing small tasks like taking surveys, playing video games, watching videos or shopping online include:
Sites like Raise operate as a sort of marketplace with the burden to sell the gift card placed on you. You'll be able to choose how heavily you want to discount your card, and you can view the discounts that others with similar gift cards are offering. You won't receive any money until someone buys your gift card. 59ce067264