By Sarah Krouse
Holly Kay bought eight $1,000 Macy's gift cards at a California mall because a scammer told her to on the Saturday before Thanksgiving. Forty minutes later, she bought $13,000 more in gift cards at that store.
The ease with which Ms. Kay was able to complete those purchases underscores the growing popularity of gift cards among scammers seeking quick, hard-to-trace ways to take money from their victims.
Buying multiple gift cards is often easier than initiating a wire transfer, because the cards are easily purchased and the numbers can be sent instantly by phone or text message to a fraudster who might otherwise have to wait for a large bank transaction to clear, law-enforcement officials say.
The gift cards Ms. Kay, 68 years old, purchased at Macy's Inc. were among nearly 120 that she bought from several retailers in one week, as part of a scam in which a fraudster told her she was helping catch a hacker who had compromised her home computer.
At the fraudster's direction, she also spent $19,000 in one hour on gift cards at a Nordstrom store. The scammer remained on the phone with her for most of the transactions and at times had remote control of her computer, coaching her on how to answer cashier questions about why she was buying the gift cards.
Gift cards sold by large retailers are increasingly used by scammers in all flavors of fraud, including robocallers impersonating government officials or online criminals pretending to be a person's employer, law-enforcement officials say. How companies respond to scammers' embrace of their gift cards varies widely.
The Financial Crimes Enforcement Network, part of the Treasury Department, has rules aimed at limiting sales of more than $10,000 in gift cards to any one person on the same day unless a retailer has systems in place to flag suspect transactions.
Still, as in Ms. Kay's case, purchases at times bypass that threshold.
A Macy's spokeswoman said it allows sales of more than $10,000 in gift cards to a customer in a single day, but has "a robust anti-money laundering program in place." The company is working to enhance awareness for customers about scam attempts and has bolstered scam-awareness training for managers, she added.
A Nordstrom Inc. spokeswoman said the retailer has controls and policies in place to limit gift-card sales to $2,000 per card and $10,000 per customer each day and that taking care of customers is its priority. "We're sorry to hear this happened to this customer. We take these situations seriously and are working with our teams to look into it," she said.
In all, Ms. Kay purchased $119,000 in gift cards at the direction of scammers around Thanksgiving, she said.
JPMorgan Chase & Co., which issued the debit and credit cards Ms. Kay used to pay for most of the gift cards, sent her three separate emails about suspect transactions on Nov. 23, and all were verified, a bank spokesman said. Ms. Kay says she has no record of the emails. Chase reimbursed Ms. Kay for $115,000, the amount she lost using her debit and credit cards from the bank.
Each retailer determines the maximum denomination of its gift cards and sets its own limits on the value of cards sold per transaction or day. Companies aren't always required to collect information such as the name or driver's license number of the buyer.
Apple Inc. added a warning in May to its in-store checkout system telling consumers that scammers sometimes ask victims to buy gift cards and warning them not to provide gift-card information to someone they don't know.
After that action, the number of reported scams by victims that purchased Apple gift cards declined in New York City, said New York Police Department Deputy Inspector Jessica E. Corey, commanding officer of the crime-prevention division.
At times, the technology company freezes the Apple IDs of users who redeem gift cards the company suspects were obtained through scams, a spokeswoman said.
Nationally, the volume of gift cards purchased in scams is difficult to quantify, because they are used in disparate scams that typically also include bank transfers, mailing cash or transmitting bitcoin.
Late last year Walmart Inc., Best Buy Co. and Target Corp. made nationwide changes to their gift-card policies after working with the Pennsylvania Attorney General's Office, in some cases lowering the maximum denomination of gift cards sold or the total value of cards that can be sold in a single transaction.
"If scammers can only get $250 or $500 at a time it may not be worth it to them to use that mechanism anymore," said Sarah Frasch, director of the Bureau of Consumer Protection in the Pennsylvania Attorney General's Office.
Walmart, for example, lowered its gift cards' maximum denomination and the daily per-person limit. Best Buy reduced the maximum denomination to $500 a card from $2,000, and the total single-day limit to $2,000 a person, from $6,000.
Target trains employees to spot suspicious customer behavior and share information about scams with consumers they suspect are falling for one.
The Retail Gift Card Association, a trade body, says best practices include using technology to flag suspicious sales, activation and balance-check activity as well as regularly reviewing cashier training and point-of-sale procedures.
Other ways retailers could make it tougher for scammers to access gift cards through victims include adding a delay between when a card is purchased and when it can be used, empowering checkout clerks to refuse to sell cards and banning gift-card sales at self-service checkouts, law-enforcement and consumer-protection officials say.
Retailers could further frustrate some scams by restricting the use of their own store cards for purchases of third-party cards such as Google Play or iTunes that can be redeemed online, they added.
Gift cards that can be redeemed online are particularly helpful to scammers because they can maintain anonymity, said Shelley Hunter, who runs a blog called Gift Card Girlfriend and often hears from consumers who have been victims of fraud.
Write to Sarah Krouse at firstname.lastname@example.org