Fraud Prevention in the Online Redemption Flow

The leading cases of fraud we are seeing in the gift card marketplace include: fraudsters writing scripts to guess active pins, bots creating new user accounts, and the desire for fraudsters to obtain codes to resell online. There are some best practices and preventative measures you can put in place to thwart this activity from occurring on your platform. 

To start with the basics, secure values such as codes or pins need to be kept secure. They should not be exposed or passed around in an insecure fashion like via email, included in reporting, or sitting in files on people’s desktops. Codes or pins should be treated as securely as cash and should be encrypted during transmission and deleted from locations where they are not needed. Also consider restricting access to codes on the customer service side, by requiring an escalation or only full time employees to handle this sensitive data; as opposed to allowing thousands of contracted agents to view these values.

The key to prevent fraudulent redemptions is to know your user and to provide little to no information to those who are not logged in to your platform. It is best practice to require login prior to allowing a redemption attempt. If authentication is not required, then you have little information on this individual and no ability to remove or freeze this person’s account, aside from attempting to block their ever-changing IP addresses. The more info you have on a person the better you can track their activity and patterns. Capturing user data including IP address, lat/long, user agent and other relevant data will help you block repeated requests with high error rates. 

Partners should have metrics and monitoring in place on their side so they can see when they are receiving a lot of invalid pin guesses, how many times a pin has been guessed, who is guessing this pin, where the pin entry came from, etc. All of this info will allow the partner to put business rules in place around this activity. Throttling is a good place to start on limiting fraudulent activity. A partner should only allow so many redemptions and redemption attempts a day/week/month and have a cap on overall value load into a user’s account. A session variable or a CSRF token can also be used to slow brute force guessing of gift cards through an automated means. Additionally, partners should log the redemption interface and location in your system to identify potential vulnerabilities, such as a browser compatible redemption option that doesn’t have all the safeguards (e.g. promo codes boxes). 

In order to get in front of fraudsters that create bots to generate new user accounts, we have found something as simple as implementing reCAPTCHA into your redemption flow (CAPTCHA stands for: Completely Automated Public Turing test to tell Computers and Humans Apart) has thwarted these attempts. 

Lastly, years ago when it was best practice to provide as much info as possible and surface up the most specific error codes to lighten the load on customer service teams, now we have found the less info provided to users the better, especially if they are not logged in. For closed loop, one time redemption cards, a balance inquiry is not really necessary and just provides information like value and status to a fraudster who will then resell this code they successfully guessed. This will result in the end user becoming a victim of fraud as their code will be redeemed by someone else before they can use it and now they are having a bad user experience on your site/app. It is best to not to provide balances or statuses and to serve up very generic error codes like “invalid pin.” If a good user has run into an invalid pin error they can reach out to your customer service team who should have more insight into why they received the error they did and can resolve the problem with this customer. The only error that should be shown to a user with specifics is an already redeemed error, if the user is logged into an account in which they have already redeemed that specific code. 

If you have a great service, fraudsters are going to want to take advantage of it. Your job is to make it very difficult to become their victim. Throw every hurdle and pain point in front of them possible so they start to look elsewhere, and stay up on the latest best practices as things are always changing in this advancing world of technology and payments.