10
Dec 15

The Role of Phony Returns in Gift Card Fraud

On any given day, there are thousands of gift cards from top retailers for sale online that can be had for a fraction of their face value. Some of these are exactly what they appear to be: legitimate gift cards sold through third-party sites that specialize in reselling used or unwanted cards. But many of the more steeply discounted gift cards for sale online are in fact the product of merchandise return fraud, meaning consumers who purchase them unwittingly help thieves rob the stores that issued the cards.

giftcardsThis type of scam mainly impacts brick-and-mortar retailers that issue gift cards when consumers return merchandise at a store without presenting a receipt. Last week I heard from KrebsOnSecurity reader Lisa who recently went online to purchase a bunch of steeply discounted gift cards issued by pet supply chain Petco.

Lisa owns two Rottweilers that both eat a good chunk of their weight each month in dog food, so Lisa said she felt like she’d really hit on a bargain when she found a $165 Petco gift card for sale at a popular online gift card retailer for $120 (a nearly 30 percent discount on the value).

“When I went to Petco to get my monthly supply of dog food and snacks for my Rotties, I used my merchandise card and the manager shared with me that folks are stealing merchandise from one Petco store and returning the items to another without a receipt and then selling the cards to places like raise.com and cardpool.com at a discounted price,” Lisa recounted.

Petco’s official policy is that for returns more than 60 days after the purchase — or if the receipt is unavailable — the value of the goods returned will be refunded to a merchandise card. Lisa said she bought the Petco card from raise.com, but she said the company never disclosed that the card was a merchandise return card — a fact that was printed on the front of the card she received.

“I feel really bad now because my purchase of these cards may have contributed to unlawful activities,” Lisa said. “Even though I saved $40+, Petco actually lost money as a result.”

Neither Raise nor Petco responded to requests for comment. But a look at the available Petco cards for sale via one gift card tracking site — giftcardgranny.com — shows Petco cards routinely sell for at least 25 percent off their value.

In any case, this fraud scheme is hardly specific to Petco. Cards from Petsmart, a competitor that also offers merchandise return cards, generally sell at 20 percent off their value. Clothier H&M’s cards average about 30 percent off.

Contrast these discounts with those for gift cards from restaurants, fuel stations and other businesses that generally don’t have to deal with customer returns and you’ll notice two interesting patterns: For starters, the face value of the cards from merchants that don’t take customer returns are far more likely to be even amounts, such as $50, $25 and $40. The percentage off the face value also tends to be much lower — between 3 and 15 percent. For example, see the discount percentage and value of cards from Starbucks and Chevron.

“Twenty-five percent off is really high, and there aren’t many that offer that high of a discount,” said Damon McCoy, an assistant professor of computer science at New York University and an expert on fraud involving stored value cards. “Normally, it is around 5 percent to 15 percent.”

According to a study conducted jointly by KingRogers International and The Retail Equation, approximately nine percent of all returns in the United States are fraudulent. The National Retail Foundation estimates that the problem will cost U.S. retailers nearly $11 billion this year.

Investigators say the crimes very often are tied to identity theft rings and drug addicts. Last month, authorities in Michigan convicted a 46-year-old father of four for running a large-scale fencing operation that used teams of prostitutes, heroin users, parolees and panhandlers to steal high-priced items from local Home Depot stores and then return the goods to a different Home Depot location in exchange for store debit cards.

Of course, another huge source card of gift card fraud are cards purchased with stolen credit cards. Thieves will buy “dumps” — card data stolen from brick-and-mortar businesses — and encode that data onto anything with a magnetic strip and try to buy high-dollar gift cards from a range of retailers. The carded gift cards very often wind up for sale online at steep 20-30 percent discounts.

Earlier this year I saw part of this process in action at a Giant grocery store in Maryland. The man in front of me in line looked and smelled homeless. The only items he was trying to buy were several $200 gift cards that Giant had on sale for various retailers. When the first card he swiped was declined, the man fished two more cards out of his wallet. Each was similarly declined, but the man just shrugged and walked out of the store. I asked the cashier if this sort of thing happened often, and he just shook his head and said, “Man, you have no idea.”

Lisa admits she remains conflicted over whether she would buy another steeply discounted card to help feed her dogs. But she said retailers could help stem this type of fraud by tying merchandise return cards to the identity of the person who returned the merchandise in the first place. Most stores that issue merchandise return cards now require the person returning the goods to show a valid state driver’s license, but the cards are not tied to that customer, nor do stores check ID when consumers use merchandise return cards at the store to purchase goods.

Tags: , , , , , , , , , , , ,

77 comments

  1. I suppose the main unanswered question is if the retailers are actually eating all of these gift card losses, or if the cards are “underwritten” by another body that is actually taking the hit.

    The amounts of money being lost vs. how little the companies appear to be doing to control the fraud make me suspicious that either they’re not footing the final bill for it OR they’re just making so much money on unused gift cards that the $11b/yr is chump change to them.

  2. The retailers set up impersonal experiences, with low importance and value attached to people in the stores.
    You are not talking about stores owned by the people working in them, and it’s unsurprising that exploitation of this lack of personal care is happening. You have not even mentioned “inside jobs” where the returns and thefts are internally co-ordinated.
    When stores are basically software run logistics systems, the only surprise is that more people are not doing this sort of thing.
    I didn’t know about this sort of thing before I read your post, but I do not go to large retailers. I like to deal with people who own their business, or who work for an owner, not a hedge fund or gigantic corporation. In this case, a return is dealt with personally, and handled properly.
    Storing “value” on a “gift card”? What do these companies expect will happen?
    I only go to places that deal with people fairly and refund their money.

    • sort_of_knowledgeable

      Real customers with a receipt would have received their cash back or reversed charges on their credit card. It’s nice for you that you have such a personal relationship with the store personnel that you can return items without a receipt, but some of us don’t shop often enough to develop that relationship.

      • The only way a store can do a non receipt return for refund is if you pay with debit or credit card and they have a system in place where they can look up the original purchase from the card.

    • You have minimum or just above minimum wage employees mostly under the age of 25 working at most of the big box retailers. Service now ranges from merely indifferent to almost outwardly hostile toward the customer. Of course with 5% unemployment and lower in many areas retailers are really scraping the bottom of the barrel these days.

  3. Alternatively, if they have a central stock management system, they could figure out the goods that are being returned haven’t been sold yet…

    • It isn’t that simple – a centralized stock management system generally doesn’t apply a unique code to each unit of an item, so you don’t actually know if the item that is being returned was the one that was sold last week, or not.

      High end items (electronics, jewelry) have unique barcodes that are able to keep track of which item was sold and when, and many retailers use that information – but that technology is cost prohibitive, and not worth using on a $4.25 dog collar.

  4. Purchasing discounted gift cards is touted as a way to save $$ by many in the media and at online savings blogs. I tried it last year. The gift cards I bought were not gift cards. They were merchandise return cards. They were advertised as gift cards. I emailed the company about the discrepancy but the last time I checked, they are still being sold as gift cards. I didn’t feel comfortable with purchasing any more.

    Not only are these gift card resellers subsidizing criminals, they themselves are not always reputable. I did a lot of research in deciding which gift card reseller to use. You would not believe some of the yelp reviews I read.

  5. For quite a few years I have adopted the practice of applying a bright yellow label beside signature panel on credit card “PHOTO ID REQUIRED”. Amazing how few cashiers will actually ask for an ID or even to see the credit card for signature verification. Does not directly impact subject of this story but certainly indicates lack of concern by retail staff.

    • Chip, it is not up to YOU whether the retailer will ask for photo ID or not. VISA has an agreement with its Point of Sale cashiers that they may NOT ask for ID in order to make a transaction- as a matter of fact, they are expressly told *not to* ask for ID (it’s demeaning to the customer, and VISA wants as many transactions as possible anyway, as it means more money for them). Cashiers are not police officers, and its not in their domain to require a person show ID. Your hand made suggestion on cards is ignored, and should be!

      Speaking of all this theft biz, this reminds me of how easy they made it for thieves with all the WE BUY GOLD ads all over. The law is that they must melt down the gold immediately: Grandma’s heirloom bracelets, wedding bands, etc- all turned into lumps. Such a shame – all of this. And they want us to be a cashless society?? For what?? To make it easier for criminals? that’s what they told us it would end- what a lie.

  6. A Florida business has been shut down for dealing in these fraudulent merchandise return cards. According to this article, over 16K cards worth $2MM were processed in a 9-month period.

    http://www.mynews13.com/content/news/cfnews13/news/article.html/content/news/articles/cfn/2015/12/14/operation_plastic_paradise_gift_card_fraud_investigation.html

  7. I used to work for one of these giftcard resale marketplaces, and helped develop the fraud model. During our initial startup period, the fraud volume was insanity. Figure 30%. As we moved forward, we became better, but the market will always be rampant with fraud. All I can say is, you need to put yourself in a fraudster’s shoes and think tactically. Not sure where that company is now, but if they’ve improved at all, the fraud model shoots down most devices and individuals who attempt to defraud them. Additionally, most of the responsibility has been transferred over to the retailer, as some giftcards have nothing but a string of numbers you could essentially guess and then use online with no authentication at all. It’s nice to see some come a long way, and some lag behind…

  8. The fix for this is for retailers to put a foot down and refuse to do returns. I never need to return anything because I put a lot of thought into what I do buy.

    A store with no returns won’t have return fraud. I suppose their stuff might be stolen to return elsewhere but hey if everybody stopped taking returns, or demanded a receipt without exception, the problem goes away. I think asking a customer for receipt is the least the customer can do to validate who they are and that a purchase was made, given how many people seem to buy buy buy and make doing a big return a normal part of their shopping process, when that’s a ridiculous concept and needs to stop. Buy the right thing the first time. Don’t buy stupid crap. Don’t do returns if you screwed up and got the wrong thing.

  9. But Brian; Starbucks *does* take returns!

    Does fraud happen? Yes. Is it a significant issue for these retailers, relative to the tsunami of profits that result from gift cards? Clearly not. If it were, we wouldn’t see every single business out there – right down to the mom&pop diner in my neighborhood – trying to sell gift cards.

    These retailers created the gift card economy, and they are profiting hugely from it each and every day. Please don’t ask us to feel sorry for them.

  10. sort_of_knowledgeable

    Sure people can buy bags of coffee from Starbucks and return them, but if 95% of what is purchased at Starbucks is consumed on the spot, generally not having to deal with returns is a fair way to describe the business relative to petco.

    And the concern is not just for the retailer but for the people with stolen credit card numbers used to purchase gift cards. Part of the money stolen from them was paid to the retailer to launder the funds.

  11. In related gift card scam, police seize 470 iphones plus more already being shipped to Hong Kong. Over 750,000 dollars purchased with “fraudulent” gift cards. No arrests have been made.
    http://katu.com/news/local/police-seize-hundreds-of-frauduently-purchased-iphones