'Grinch bots' and gift card defrauders threaten holiday shoppers

A variety of online scams are targeting consumers this holiday season, with automated schemes ranging from outright theft to “Grinch bots” meant to snag a purchase right before you do.

At the top of the list for many public and private officials: gift card thieves. Indeed, the Federal Trade Commission says that about 1 in 4 Americans who report they’ve lost money say they paid with a gift card.

Since 2018, this payment method has topped the list of fraud payments, losing a reported $245 million, with a median individual loss of $840, according to FTC data.

With supply chain issues adding uncertainty to shipping times and inventory, experts say prepaid cards are becoming even more popular as a more reliable gift. The pandemic has also pushed more people online generally, adding to their exposure to digital scammers.

“You have all this money just sitting there, which is almost begging for someone to start testing these combinations of pins and gift card IDs in order to crack into them and sell them,” said Sam Crowther, the founder of Kasada, a company that helps retailers combat such hackers.

Fraudsters’ bots, or automated software, perform tasks such as generating and testing gift card numbers until they hit. When a combination of numbers hits an actual card, the scammers sometimes put a counterfeit one up for sale — for a fraction of the value.

“They’re selling $5 gift cards for $1.49, $15 gift cards for $5.99, and they’re happy they make a profit. Maybe they sell the same gift card a few times and so the first person to use it wins,” Crowther added.

Marketing and strategy consultant Lisa Miller said she saw the gift card boom back when she ran the gift card program for Brinker International, the parent company to restaurants like Macaroni Grill and Chili’s. She’s also seen thieves adapt their practices over the years.

“Gift cards in general, particularly in the restaurant space, are a great way to gift an experience,” Miller told Yahoo News.

“Now, thieves are actually trolling inboxes in your email to actually grab Amazon gift cards. Grab even, you know, reward points, and so on just right out of your email, which is really quite amazing. So technology has changed quite a lot,” she said.

Both experts said the best way to protect your gift is to redeem it immediately rather than letting the money sit unclaimed on the card. Miller also suggested checking a store’s policies when purchasing a gift card.

“I think the best bit of advice is use it,” Crowther said, adding, “The longer it’s out there, just the higher chance someone else may get access to it.”

Another tip to avoid related scams, according to the FTC, is to reject anyone who demands to be paid with a gift card.

It’s also important to order gift cards directly from a retailer or established vendor, not a seemingly random website offering huge discounts. If a gift card’s price seems too good to be true, it probably is.

But gift card scams aren’t the only threat to consumers this holiday season. The same automated bot technology that allows hackers to generate endless gift card redemption codes is also being used to snap up products in bulk. The so-called Grinch bots then sell the same products back to confounded buyers — at a significant profit for themselves.

“Last year, [the term 'Grinch bot'] was coined when it was the first time that we had seen bots used to buy things that the everyday person wanted, going to the PlayStation 5s and the Xboxes. Once they hit those consoles, that’s when it really started happening,” said Crowther, who also cited sneakers and other hot items that often sell out.

Rania Mankarious, the CEO of Crime Stoppers of Houston, said Grinch bots are adding to the supply chain issues already confronting many retailers and consumers this holiday season.

“They hit hot markets, they use the economy, they wreak havoc on a number of retailers selling real items that people want this holiday season,” said Mankarious. “And then after they’ve upended the supply chain and they’ve taken advantage, of course, of what we’re all dealing with right now, which is this backlog of product coming to market, they resell it. They’ve cornered the marketplace, and they’re now going to resell it at an extreme profit.”

Unlike gift card fraud, Grinch bots aren’t illegal. But some lawmakers are looking to change that, announcing last month that they had introduced the Stopping Grinch Bots Act. The legislation would outlaw these new bots in a way similar to a 2016 bill that outlawed “ticket bots” for popular events, the announcement said.

“The average holiday shopper is unable to compete with the light speed of the all-too-common Grinch bot and are then held at ransom by scalpers and third-party resellers when trying to buy holiday presents. After a particularly trying year, no parent or American should have to fork over hundreds — or even thousands — of dollars to buy Christmas and holiday gifts for their children and loved ones,” said Senate Majority Leader Chuck Schumer, one of the bill’s sponsors.

Mankarious added: “I don’t know that it will help us this holiday season. It still has to go through the entire legislative process. But at least we’re on top of it, and I think that’s important.”