The tell is the packaging, and it is meant not to be

2025 United States Ongoing

Homeland Security Investigations' guidance to retailers describes the core problem with card draining: the packaging is opened, the card data taken, and the card re-packaged in a way that makes the tampering difficult to see. Its recommendations are all about the shop rather than the shopper, which is a judgement about where this can actually be stopped.

Year
2025
Where
United States
Outcome
Ongoing
Victims
Not stated in the sources
Schemes
Gift card draining
Last reviewed
2026-09-06

The facts, as recorded

Why this case matters

Every other scheme on this site can be stopped by the person being targeted. This one mostly cannot, and HSI’s guidance says so by where it is aimed.

Five recommendations, and every one of them is addressed to the retailer: learn the signs of organised crime groups in your store, adopt tamper-evident packaging, deploy technology to monitor gift card transactions, share intelligence with law enforcement, train staff to spot compromised packaging.

None of them is something a shopper can do.

Why the consumer advice is weak, honestly

The advice given to shoppers — check for torn edges, compromised pull tabs, missing PIN covers, mismatched branding — is worth following and is not much of a defence.

HSI explains why in its own description of the technique: the cards are re-packaged in a way that makes it difficult to tell that the product has been compromised. The whole craft of the thing is producing a package that survives exactly the inspection consumers are being told to perform.

We are saying that plainly rather than repeating the checklist as though it solved the problem. It raises the odds; it does not settle them.

What actually works, and who has to do it

Tamper-evident packaging is the structural fix, because it changes what the criminal has to achieve rather than what the shopper has to notice.

Transaction monitoring is the other one. A drained card is detectable at the moment the balance is redeemed — from an unusual place, at an unusual speed, in an unusual pattern — and only the issuer can see that.

Both are the retailer’s to implement, which is the same conclusion as the robocall order and the printer prosecution: the effective intervention sits with the business in the middle, not with the person being harmed.

The reporting address

[email protected], referencing Project Red Hook.

We record it because it is unusual — a dedicated federal inbox for one fraud type, addressed to retailers rather than victims — and because it tells you that the intelligence this investigation runs on comes from shops noticing things, not from consumers filing complaints.

What a shopper can actually do

Three things that do not depend on spotting a well-made repackage:

Buy from behind the counter where the retailer offers it, rather than from an open rack. Keep the receipt and the card together, because a refund claim needs both. And check the balance immediately on activation rather than at the moment somebody tries to use the gift — which is the difference between a dispute and a discovery months later.

Sources

  1. Recognizing and Responding to Gift Card Fraud in Retail. US Homeland Security Investigations, Immigration and Customs Enforcement. Accessed 2026-09-06. Supports: The repackaging description, all five retailer recommendations, the export and resale of goods bought with drained funds, and the [email protected] reporting route.
  2. Tackling the Rise in Gift Card Fraud. US Homeland Security Investigations, Immigration and Customs Enforcement. Accessed 2026-09-06. Supports: The consumer-facing signs of tampering and the Project Red Hook context.

If a legal outcome in this case has changed, please tell us and the page will be corrected. See the corrections policy.