Gift Card Barcode Scams: The One Check That Actually Works

You buy a $100 gift card, the cashier scans it, you pay, and you hand it over as a present. A week later the recipient tries to use it and the balance is zero. Nothing was wrong with the receipt. Nothing was wrong with the card. The money went where the barcode told it to go, and the barcode was not the card's.

This is the swapped-barcode scam, and it works because a gift card carries its identity twice: once in bars that a till can read, and once in digits that a person can read. Everyone checks the digits. The till reads the bars. Nothing whatsoever forces those two to agree.

Consumer advice on this is near-universal and, on the central point, wrong. It tells you to run a finger over the back of the card feeling for a raised sticker, and to check that the number printed under the barcode matches the number on the packaging. Both of those tests can be defeated by a sticker that costs a fraction of a cent to print. This article explains why, and gives you the one test that cannot.

How the Swapped-Barcode Scam Works

Gift cards on a rack are inert. They carry a number, but no money, until a cashier scans one at the point of sale and the issuer's system loads the purchase amount onto the account that barcode identifies. The card is a pointer; activation is what puts funds behind it.

That gives a thief a clean attack. They acquire a card of their own from the same programme and keep its number. They print a sticker carrying their card's barcode. They apply it over the barcode on a card sitting on a retail rack, and put it back. When you buy that card, the till reads the sticker, and the issuer loads your money onto the thief's account. Your receipt is valid. Your card is genuine. It is simply not the card that was funded.

The thief does not need to be anywhere near the store when this happens. They monitor their own card's balance and spend it the moment it jumps, which is usually within minutes of your purchase. By the time the gift is opened, the money is long gone — and because the funds were loaded correctly onto a real account, there is often no fraud flag anywhere in the chain.

Public warnings about this pattern have come from the FBI (its El Paso field office published a "Tech Tuesday" advisory specifically on fake barcodes on gift cards), from the Better Business Bureau, and from a long list of local police departments and state attorneys general. The mechanism is not disputed. What is weak is the advice attached to it.

Why "Feel for a Raised Sticker" Is Not Enough

The standard tactile test asks you to detect a label by touch. It catches careless work: a sticker with a lifted corner, a visible edge, a mismatched finish. It does not catch careful work.

Thermal-transfer label stock sold for retail use is routinely under 0.1 mm thick, applied with a pressure-sensitive adhesive designed to sit flush. Someone doing this at volume — and the arrests reported in this area have involved people carrying hundreds of tampered cards — is not producing lifted corners. They are producing labels that look and feel like print.

The test also has a false-negative problem in the other direction, which matters for how you act on it. Plenty of legitimate gift cards carry genuine stickers: activation labels, regional price labels, retailer overlays. "I felt a sticker" is not proof of tampering, and "I felt nothing" is not proof of its absence. It is a weak signal in both directions, offered as though it were decisive.

The Detail Almost Every Guide Gets Wrong

The more technical-sounding advice is to compare the digits printed beneath the barcode with the number printed on the packaging, and to ask the cashier to read back the serial number their scanner picked up. The second of those is genuinely useful. The first rests on a misunderstanding of what a barcode is.

The line of digits under a barcode has a name in the standards: the human-readable interpretation, or HRI. It is there so that a person can key the number in when a scan fails. And that is all it is — ordinary printed text, placed in the artwork by whoever produced the label. It is not derived from the bars. No scanner compares it to the bars. No barcode specification requires the two to agree, because nothing in the scanning path ever reads it.

So a thief printing a sticker prints the bars for their own card and, underneath, the digits of your card. Both halves of the sticker are deliberate. Hold it up to the light, read the digits, compare them to the packaging: perfect match. Scan it: a completely different number. The check you were told to run is the one check the attack is designed to pass.

This generalises well beyond gift cards. If you are inclined to trust the digits under any barcode, how the common symbologies actually encode data is worth twenty minutes — the printed line is a convenience, never a guarantee.

Why No Checksum Catches This Either

A reasonable next thought is that barcodes have checksums, so a forged one should fail. It does not, and the reason is worth understanding because it rules out an entire category of defence.

Gift card barcodes are almost always Code 128, standardised as ISO/IEC 15417. Every Code 128 symbol carries a check character computed as a weighted sum of its code values, taken modulo 103. You can see the rule directly in ZXing, the open-source decoder behind a great many scanning apps: its Code 128 reader accumulates checksumTotal += multiplier * code across the symbol and then throws a checksum exception unless checksumTotal % 103 equals the check character it read. It then deletes that character from the string before handing it back, which is why the decoded text you see is just the data.

Now ask what that check is for. It detects a misread — a smudged bar, a bad scan angle, a damaged label. A swapped sticker is none of those things. It is a correctly printed, perfectly valid Code 128 symbol. It satisfies the mod-103 check exactly, because it was generated properly. It just encodes somebody else's card.

The same holds one level up. Visa- and Mastercard-branded prepaid gift cards carry a 16-digit number whose last digit is a Luhn check digit, the formula defined in ISO/IEC 7812-1. A swapped barcode passes that too, because it holds a real card number from a real programme. Closed-loop retailer cards mostly have no public numbering standard at all, so there is often nothing to check.

The general principle: checksums detect corruption, not substitution. A valid number is not an authentic one. This is the same trap that makes a correct check digit on a suspicious tracking number so misleading — the arithmetic confirms the digits are well formed and tells you nothing about provenance.

The Check That Actually Works

If the printed digits cannot be trusted and the checksums cannot help, only one option is left: decode the bars yourself and compare the result to the number on the card. That is what the till will read, and it is the only representation the attacker cannot fake without defeating their own purpose.

Three steps, before you reach the checkout:

1. Scan the barcode on the back of the card — through the packaging window if it is still sealed.
2. Read the decoded text your scanner returns. Not a lookup, not a web result: the raw characters.
3. Compare it to the number printed on the card or packaging.

The gift card barcode checker does the comparison properly, including the cases that trip people up: extra leading or trailing characters, formatting differences, and partial scans. It runs entirely in your browser, which matters for something as sensitive as a card number.

There is a practical obstacle. Code 128 is a linear symbology, and the built-in camera apps on iPhone and Android are built around QR codes — point the stock camera at a gift card and typically nothing happens at all. You need a scanner that handles linear formats and shows you the decoded string rather than immediately acting on it. What barcodes your phone can scan has the per-platform detail on where the gaps are.

A Worked Example

Suppose a card is printed 6006 4912 3456 7890 and the barcode on its back decodes to 6006491000000111. Normalise both — strip the spaces — and line them up:

They diverge at the eighth character. Both begin 6006491, and that shared opening is the informative part: a card number's leading digits identify the programme it belongs to, so these are plausibly two cards from the same issuer — exactly what you would expect if someone lifted a barcode from another card on the same rack. A sticker from an unrelated programme would differ in the first character or two instead.

Either way the outcome is identical. Pay for this card and the issuer funds account 6006491000000111, which belongs to whoever printed the sticker.

What a Match Does and Does Not Prove

The barcode comparison closes one hole precisely. It does not close the others, and it is worth being exact about which attack each check actually covers.

That last row deserves emphasis, because it is where the barcode-aware shopper most often comes unstuck. Searching for a balance-check page and clicking the first result is how a great deal of gift card value is lost. Type the issuer's address in yourself, or ring the number printed on the back. The same instinct applies to any code you are invited to scan in a public place — fake QR codes stuck over legitimate ones are the same substitution attack in a different symbology, and a link checker is the equivalent pre-flight test.

Draining: the Attack That Never Touches the Card

Everything above assumes someone physically interfered with a card on the rack. One of the most common ways gift card value disappears involves no tampering at all, and it is worth understanding precisely because no amount of inspecting the card in your hand can detect it.

It is usually called gift card draining, or card cracking. A retailer's balance-check page accepts a card number and a PIN and answers with a balance. That is a useful feature and also an oracle: a bot can submit guesses at industrial rates and keep whatever answers with money on it. Where a programme issues numbers in predictable sequences, the guessing gets dramatically cheaper. The best-documented example is the GiftGhostBot botnet, publicly reported by researchers at Distil Networks as testing on the order of 1.7 million gift card account numbers an hour against retailers' balance pages, with one site seeing bot traffic at roughly ten times its normal volume.

The consequence for a shopper is specific and slightly counter-intuitive. The card you bought was never opened, never re-stickered, and its barcode matches its printed number perfectly. The money was taken from the account the number points at, from somewhere else entirely, possibly before you bought it and possibly minutes after you loaded it. This is why "the packaging was intact" is not reassurance, and why the comparison this article recommends is honestly described as closing one hole rather than solving gift cards.

What does help is reducing the window and keeping proof:

• Spend or load it promptly. A balance sitting unused on a card for three months is a target for three months. Transferring it into a retailer account or app the day you receive it takes it out of reach of the balance-check endpoint.
• Keep the receipt and the card together. If a balance vanishes, the receipt is what establishes the card was funded, which is the one thing a retailer can act on. Gift cards carry none of the fraud rights a credit card does, so documentation is most of your position.
• Check the balance through the issuer's own app or phone number, never a search result. A page that asks for the number and the PIN together in order to tell you a balance is either the issuer or an attacker, and from the outside those look identical.
• Prefer a card activated at the till over one with a pre-printed balance where the programme offers the choice, since the funds exist for less time before they reach you.

None of that is a reason to avoid gift cards, and none of it is detectable at the rack. It is the part of the problem that sits with the issuer's engineering rather than with you — rate limits on balance lookups, non-sequential numbering, a second factor on high-value redemptions — which is also why coverage of draining tends to be written for retailers rather than for shoppers.

If the Numbers Do Not Match

Do not buy the card, and do not simply put it back on the rack. Take it to the customer service desk and say that the barcode does not match the number printed on the card, so it can be pulled from sale rather than sold to the next person. Retail staff are increasingly briefed on this, and in several states they are now required to be.

Then pick a replacement, with two preferences: packaging that shows no sign of having been opened, and a barcode you can actually scan through the window. A pack that hides the barcode hides the swap too.

The Law Has Started to Move

Gift card tampering has moved from consumer-advice territory into statute, which changes what you can expect to see on a rack. As of October 2026:

• Maryland — the Gift Card Scams Prevention Act of 2024 took effect on 1 October 2025 and is reported as the first US state law to require that gift cards sold in person be in secure packaging, sealed so that tampering shows.
• New Jersey — its requirement took effect on 1 October 2025 with enforcement from 1 February 2026. Retailers may not display or sell a gift card unless the card or its packaging prominently carries a tampering warning along the lines of "Do not sell or purchase if the gift card or its packaging has been broken or indicates tampering".
• Hawaii — SB 2797, introduced in January 2026, would add secure packaging, notice posting, employee training and storage requirements.
• Bills in the same family have been introduced over the past two years in Delaware, Iowa, Maine, Nebraska, New York, Pennsylvania, Rhode Island and West Virginia.

Two practical consequences. First, a broken or resealed pack is now, in some states, something a retailer is legally barred from selling you — so reporting one is not a favour, it is the mechanism working. Second, none of these laws require the barcode to be verifiable. Tamper-evident packaging raises the cost of the attack; it does not make the printed digits trustworthy. The comparison check stays necessary.

Requirements differ by state and are changing quickly, so treat the list above as a snapshot and check your own state's current rules rather than assuming.

Buying Gift Cards Safely This Season

Ranked by how much they actually help, not by how often they are repeated:

• Scan the barcode and compare it to the printed number. The only test that sees what the till sees.
• Buy digital, or from behind the counter. An e-gift card issued directly has no physical barcode to swap; cards kept behind the till have not been sitting on an open rack.
• Take a card from the back of the rack. Tampered cards are replaced at the front, where they sell first.
• Check the scratch-off panel and the packaging seal by eye. Catches the PIN-harvesting variant that the barcode check cannot.
• Ask the cashier to read back the number their scanner picked up. A second look at the same decoded value, at the moment it matters.
• Keep the receipt and register the card immediately. Your only evidence if the balance is wrong, and the fastest route to a replacement.
• Check the balance only through the issuer's own address. Typed in by you, not followed from a search result.

One final note on who this falls on. It is genuinely unreasonable that buying a gift card requires understanding the difference between a barcode and the digits printed under it. But until packaging makes the swap impossible, the barcode comparison is a ten-second check that defeats an attack none of the usual advice touches — and ten seconds at the rack is cheaper than explaining an empty card to whoever you gave it to.

Frequently Asked Questions

Can a gift card barcode really encode a different number than the one printed on the card?

Yes, and nothing prevents it. The digits beneath a barcode are the human-readable interpretation — ordinary text placed in the artwork by whoever produced the label. They are not generated from the bars, and no scanner ever compares the two, because the scanning path does not read the printed line at all. Someone printing a sticker chooses both halves independently, so they can show your card's digits above a barcode for theirs.

How do I scan a gift card barcode with my phone?

You generally need a dedicated scanner app rather than the built-in camera. Gift card barcodes are Code 128, a linear symbology, and the stock camera apps on iPhone and Android are built around QR codes — pointing the default camera at a gift card usually produces no response at all. Use a scanner that reads linear formats and displays the decoded text rather than acting on it, then compare that text to the printed number.

Does a valid check digit prove a gift card has not been tampered with?

No. A swapped barcode sticker is a correctly printed barcode for a real card, so it satisfies every checksum in the chain: the Code 128 symbol's own modulo-103 check character, and the Luhn check digit on the card number where the programme uses one. Checksums are designed to catch damage and transcription errors, not substitution. Only comparing the decoded value with the printed value detects a swap.

Why do the barcode and the printed number sometimes differ legitimately?

Because issuers often wrap the card number in extra characters. A fixed programme prefix at the front, or a PIN, sequence number or check character at the end, are all common, so a barcode that is longer than the printed number but contains it is normal. What is not normal is a barcode encoding a different number. The distinction is containment: extra characters around the printed number are routine, a different number entirely is not.

Is it safe to buy gift cards from a store rack at all?

It is reasonably safe if you check the card, and the checks take seconds. Take one from the back of the rack rather than the front, look at the packaging seal and the scratch-off panel, and scan the barcode to confirm it matches the printed number. If you would rather not check, buying a digital gift card direct from the issuer or taking one from behind the counter removes the physical tampering opportunity altogether.

What happens if I already bought a tampered gift card?

Contact the retailer that sold it and the card issuer immediately, with the receipt and the physical card. The receipt is what links your payment to a specific activation, and it is the basis of any replacement. Report it to your state consumer protection office or attorney general as well — several states now regulate gift card packaging, and reports are what drive enforcement against the racks being targeted.

Do gift card numbers use the Luhn check digit?

Visa- and Mastercard-branded prepaid gift cards do, because they are payment cards carrying a 16-digit number under ISO/IEC 7812-1, where the final digit is a Luhn check digit. Closed-loop retailer cards follow no public numbering standard, so many of them do not use Luhn at all and a failure proves nothing. That is why a Luhn result should never be read as a verdict on a retailer gift card.

What is gift card draining, and does checking the barcode stop it?

Draining — also called card cracking — is when bots guess card number and PIN combinations against a retailer's balance-check page and empty any account that answers with a balance. Comparing the barcode to the printed number does not stop it and cannot, because nobody touched your card: the barcode matches, the packaging is intact, and the money was taken from the account the number refers to. The defences that do help are loading or spending the balance promptly, keeping the receipt, and only ever checking a balance through the issuer's own app or phone number.

Does tamper-evident packaging solve this?

It raises the cost of the attack without closing it. Sealed, tamper-evident packaging makes it harder to apply a sticker unnoticed, which is why Maryland and New Jersey now require it for in-person sales. But no packaging law makes the printed digits verifiable against the bars, and resealing is a skill rather than an impossibility. Scanning the barcode remains the check that does not depend on how good the forgery looks.