MY TAKE: How a ‘gift card’ thief spoiled my Christmas

By Byron V. Acohido

Upon returning from a holiday trip this week, we received unsettling news. There has been a rash of mail theft emanating from our local post office. Our box of held mail seemed lighter than it should have been. And one envelope was slashed open; the gift card sent to us, missing.

Our experience fell in line with similar reports from around our neighborhood. It was a stark reminder that despite the wide adoption of chip cards, the lowly “magstripe” wallet card is still in wide use – and remains a prime target of thieves.

Related article: How fraudsters became so enamored with magstriped cards

Magstriped cards consist of magnetized particles impregnated on a thin band. This decades old technology is perfect for holding data, including account information. Anyone can easily extract this data from a magstriped card simply by purchasing a $70 card reader.

Longstanding exposure

And it’s equally simple to purchase blank cards and impregnate their magnetic stripes with whatever data you’d like, including account information extracted from a legit card. This intrinsic weakness of magstriped cards is exactly why U.S. banks finally got around to replacing mag-striped credit and debit cards with chips cards, years after banks in Europe and Canada had already done so.

There was a period from 2005 through 2014 when crime rings plundered account information from the likes of TJX, Heartland, Sony, Target, Home Depot and many more. Criminals got increasing efficient at creating faked credit cards, and then sending teams of mules to make thousands of dollar of purchases at the self-check out lines  Sam’s Club and WalMart, and online, as well. That specific type of faked-credit-card fraud has slowed considerably, due to adoption of chip cards. But magstriped cards continue in wide use, not just for gift cards, but on employee access cards, public transit tokens, phone calling cards, even hotel card keys.

$70 magstripe reader

Retailers’ main precaution is to cover gift-card magstripes with a security decal. And cards are not activated until purchased and paid for.  But think like a criminal for just a moment, and the criminal opportunities jump out.

Mailed gift cards, paid for, and ready for use obviously are the lowest hanging fruit. They are ready for use in check out lines or online. And they are floating around by the thousands in mail this time of year. Thus the incentive to steal any envelope that appears to hold a magstriped card.

Motivated thieves

It doesn’t stop there. Fraudsters are motivated, the risks are low and the payoffs lucrative. So thieves are shoplifting gift cards hanging on the rack at your local supermarket or retailer. Since cards off the rack must be activated by the retailer, they have to then go through a few more steps to cash in.

One scheme is to peel off the security decal, swipe the card through a card reader, replace the decal, and replace the cards back on the for-sale rack where they came from. A spy then watches the rack, and as soon as one of the tampered cards gets purchased, an accomplice is alerted. The accomplice then makes on an online purchase, using the information extracted from the just-activated card.

Consumer loses

That’s apparently what happened to a Denver man, Josh Layton, who was dismayed to learn a $50 gift card he purchased at the Highlands Ranch Walmart was nearly drained when we tried to use it. Layton says he spent 77 minutes on the phone with Walmart officials – but never got his money back.

Cybersecurity blogger Brian Krebs has filed this report about gift cards with tampered security decals discovered for sale at that same Walmart. If it’s happening there, folks, you can bet your sweet bippy it is happening elsewhere, most likely on a wide scale basis.

Acquiring a gift card is as easy as buying a pack of gum at the grocery store or ordering a novel online. Thousands of banks, credit unions, supermarkets, drugstores and convenience stores offer them; they can be picked up at a grocery checkout line or ordered from online banking websites or sites such as iCardGiftCard.com. And they work at millions of restaurants and shops, on-premise and online.

It’s no wonder mail theft has come to haunt our quaint, rural community of Kingston, Wash. This is something all consumers should think about, and account for.  We live in an age where we need to be wary of mailing gift cards, and be alert for any you expect to receive. Also, if you’re buying gift cards off the rack, check closely to see if the security decal appears to have been tampered with. If so, the card may get drained before you get around to using it. Happy holidays!

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someone