I-Team: Cyber Security Expert Warns 'It's Not Safe To Purchase Gift Cards'
(CBSDFW.COM) - Have often have you given or received a gift card only to find out it has a zero balance?
Gift cards are not only one of the hottest items for gift givers and gift recipients but also for thieves. One cyber security expert tells CBS 11 all unpackaged gift cards on store shelves should all be destroyed.
Truman Bradshaw is a former Fort Worth police officer who bought an Amazon gift card at his local CVS Pharmacy. "I'm on a fixed income and 100 dollars hurts," he said.
Bradshaw sent that gift card to a friend who was throwing a party for a little girl. "It was a special party for her," he said.
But sadly, that party never happened because the friend was told the card had already been used.
"It was rejected immediately," Bradshaw said.
Bradshaw went back to his CVS and called Amazon. He showed the CBS 11 I-Team his proof of purchase. The receipt clearly showed he'd paid $100 for the gift card.
But Bradshaw says both retailers said there was nothing they could do.
"I don't know how anyone could use the card prior to me buying the card," Bradshaw said.
The I-Team didn't know how it could happen either -- until last holiday season.
"This happened to me too," senior investigative reporter Ginger Allen told Bradshaw.
Allen sent her father a restaurant gift card. When he went to use it, he, too, was told there was a zero balance on the card.
"It's extremely simple," cyber security expert Will Caput said. "… and that's why this is so widespread."
Caput says it is also extremely common. "It's not safe to purchase gift cards... All the ones that are on shelves are compromised. They should just be destroyed," he said.
Years ago, a restaurant chain hired Caput to dig into its security.
He grabbed a stack of the company's gift cards. By detecting a pattern in the numbers on the cards, Caput discovered just how easily he could transfer money from one card to another.
All he needed was a card writer, a laptop and simple math. He carried a small box into our CBS 11 conference room with all the supplies needed to show us just how easily this is done.
"So the card no longer matches 2909, 2901 so this is someone else's card," Caput said, quickly transferring the value of a loaded card to another card.
Caput says this is how crooks are draining the money from the cards we buy and putting it on their cards -- all before our recipients ever use them.
In the last four years, Caput says he has spoken at seven security conventions trying to convince hundreds of retailers the importance of cracking down on these cards.
He says some businesses have tried tamper-resistant stickers but you can buy those online.
"You can match the exact sticker to whatever vendor," Caput said, showing us a variety of sticker options. He showed CBS 11 how thieves scratch them off, get the number and then replace the stickers before returning the cards to store shelves.
Caput says pins on cards and the "I'm not a robot" system on websites have slowed hackers down.
But, he says, the only real fix is completely enclosing the cards with packaging that prevents the numbers from being seen without completely tearing apart the envelope. As you'll notice on store shelves, only a few vendors have done this.
"I saw your story and that brought me to reach out to you," Caput said. He saw our first story, which aired a year ago when this first happened to Allen.
"Not enough action has been taken and I feel consumers are just getting taken advantage," Caput said.
Consumers, such as Truman, say the retailers get their money either way so they have no incentive to fix the problem.
"There has to be some kind of legislature or law... I'll never send another one in my life," Bradshaw said.
The I-Team reached out to Amazon and CVS. Amazon investigated and immediately refunded Truman his $100.
CVS Pharmacy also responded quickly giving Truman $100 for the inconvenience as well as a $100 CVS gift card.
Each retailer provided the I-Team the following statements:
CVS Pharmacy:
"Gift card and prepaid card scams are a challenge to all retailers. Cvs pharmacy is committed to ongoing efforts to warn customers about these types of scams. Our employees receive training on recognizing warning signs of these scams, including purchases involving large dollar amounts and customers who are purchasing cards for someone they don't personally know. Over the years we have helped prevent many customers from becoming victims of prepaid card scams.
We also warn customers through our point of sale system. Customers who purchase a gift card at cvs have to read and acknowledge a prompt on our payment terminal about various types of gift card scams in order to proceed with the purchase. To further protect our customers, we require identification for any purchase of gift or prepaid cards $300 or more, and we have a one-day transaction limit of $2,000 for these products. We strongly recommend that customers protect themselves from scams by never providing any prepaid card information to someone they don't know and to refuse any offer that asks them to buy prepaid cards.
Regarding Mr. Bradshaw's case, there is no evidence that the amazon gift card he purchased at cvs was compromised in the store. However, a member of our Dallas leadership team has contacted him and we are providing him with a cvs gift card of equal value for his inconvenience. We also previously provided him amazon's contact information to report the issue he had with their gift card."
Amazon:
"Customer trust is a top priority. Amazon works to evolve ahead of bad actors to safeguard products and features from misuse. Customers who encounter any issue claiming gift cards are encouraged to contact amazon customer service. We encourage customers to only share gc details with someone they know or trust- and always take steps to verify the identity of anyone asking to provide gift card information. More information on gc scams can be found on our common gift cards scam page."