Kevin Wilson was thrilled when, as part of a Black Friday promotional deal, he got two Walmart gift cards totalling $700.
But when he went to a Walmart near his home in Surrey, B.C., this month to use his cards, Wilson was dismayed to discover they’d been drained — leaving him with a balance of just 27 cents.
According to transaction records, one card’s cash was spent at a Walmart in Richmond, B.C., and the other, at a Walmart in Mississauga, Ont. — far across the country.
“I was in shock. The cards hadn’t left my possession,” said Wilson. He added that the cards showed no signs of being tampered with.
“It was just like utter disbelief. How is this possible?”
Toronto-based cybersecurity analyst Ritesh Kotak says gift cards are attractive to fraudsters because they’re not registered in anyone’s name, and they’re easily accessible in stores.
“Unfortunately, people are getting scammed,” he said. “These fraudsters are becoming even more sneaky and sophisticated.”
The Canadian Anti-Fraud Centre said that between January and September, it had received more than 1,000 complaints from victims of gift and prepaid card fraud, totalling upward of $3 million in losses.
Kotak said those numbers will likely rise over the holidays, because the cards are a popular gift item.
“People are going to be victimized, but they’re not going to find out until after the holiday season when they try to use those gift cards.”
‘The light bulb went off’
After he got scammed, Wilson took it upon himself to investigate.
He said when he received his gift cards, he was so pleased that he briefly posted a photo of them on Facebook. The bar codes were visible in the photo, but Wilson didn’t think that was a problem, because the security code on each card was hidden.
But after doing some sleuthing, Wilson realized that his photo may have enabled fraudsters to access his cards. That’s because a shopper can make purchases at self-checkout with a Walmart gift card simply by scanning its bar code — or a photo of the bar code.
“The light bulb went off,” said Wilson. “There was a Eureka moment and I’m like, ‘No way, it couldn’t be that easy.'”
As an experiment, CBC News loaded $5 on a Walmart gift card and attempted to purchase a $3 bag of walnuts at self-checkout by scanning a photo of the card’s bar code. The transaction went through, and the receipt showed the card’s remaining balance.
Walmart’s gift cards are worthless until customers load them with cash. Once loaded, the company requires shoppers to input a card’s hidden security code when using it to make purchases online, but not at self-checkout.
Wilson says a fraudster could easily take photos of a bunch of the cards’ bar codes at Walmart, and then try to buy goods with them at self-checkout at a later date — in the hopes the cards have since been loaded with cash.
“It’s sort of, like, egregious,” he said. “All the cards in Walmart are on bulk display. The bar codes are in plain sight.”
Walmart Canada spokesperson Stephanie Fusco told CBC News that the retailer is investigating Wilson’s case and will reimburse him the missing $700 if it determines he’s a victim of fraud.
Fusco said Walmart has implemented measures to help protect customers from gift card scams, including signs in stores warning them not to share the information on their cards.
Another gift card scam
Nichelle Laus of Mississauga, Ont., almost fell for a different gift card scam. The former Ontario police officer posted her story on social media as a warning to others.
“It drives me crazy to have people victimized this way, especially during the holiday,” said Laus.
Her saga began in October when she tried to buy a $50 Winners gift card at Shoppers Drug Mart. She said the cashier felt the back of the card and informed Laus a fraudster had placed a sticker of another gift card’s bar code overtop of the Winners card’s bar code.
Laus said the cashier then scanned the new bar code, which showed it belonged to an Esso gift card.
She said the cashier explained that if Laus had loaded $50 onto the Winners card, it would have wound up instead on a fraudster’s Esso card.
“The cashier was telling me it’s a big problem,” said Laus. “Had she not noticed — and I wouldn’t have noticed, I would have literally paid 50 bucks, gone away with my card, and it would literally be of no value.”
Earlier this month, Laus encountered the same scam when selecting a $100 Playstation gift card at another Shoppers. This time, it turned out the bar code placed over the original one belonged to a card for the LCBO, Ontario’s liquor stores.
“Had the transaction gone through, I would have loaded $100 on [the LCBO card],” she said.
Loblaw, which owns Shoppers, told CBC News gift card scams are widespread and that its employees are trained to recognize the fraud, including bar code tampering.
Cybersecurity analyst Kotak said that for a few hundred dollars, scammers can easily acquire the necessary software, printer and labels to replicate bar codes.
“If you’re putting these labels on hundreds of gift cards across the country, you’ll be able to recoup your investment very quickly,” he said.
To protect people from gift card fraud, both Kotak and Laus recommend retailers keep the cards behind the counter, so fraudsters can’t tamper with them.