Activate at purchase only
A physical gift card should be worth nothing until it is activated at the till, in the same sale that pays for it. That single rule makes a stolen blank from the rack useless. It is the control that matters most for cards sitting where customers can touch them. Do not preload a stack "to save time" before a holiday weekend. Preloaded cards are already money. If they walk away, you have given away the balance. Activation belongs at payment, for the amount just purchased, on that card. Staff should see the value appear when the sale finishes, not before. For a Canadian shop owner, gift card fraud often starts when a blank card already has value, so activation belongs in the sale that pays for it.
Protect codes and balances
Card numbers should be long, unique, and hard to guess. Short codes and sequential numbers are an invitation to try balances until one works. Scammers script those checks. They are not standing at your counter. Protect the balance-check page with a limit on how fast attempts can arrive, and use a PIN where the program supports one, so knowing the card number is not enough. A real guest checks a balance once. A script checks it in a burst. Shut the burst down without making the single check painful. The same care applies to a code sent by email.
Limit risky behaviour
Set a limit on large bulk purchases, and watch patterns that do not match the day. Fraud often shows up as volume: many cards, bought or drained together, sometimes in a rush, sometimes with a request to skip the normal steps. One birthday card is ordinary. A stack might be a real company gift, and it might not. The override for the limit should be a manager, not a closer who wants the line to move. For cards sold online, use the same card-not-present fraud tools you use on other remote payments, because a digital code is easy to forward.
Keep it invisible to customers
Done well, these controls are silent for a genuine buyer. They choose a card, pay, and the balance exists. They redeem it later with no extra quiz. Activation, long numbers, a bulk cap, and a slowdown on repeated balance checks run behind that ordinary sale. The birthday card should still take one step at the till. A manager step appears for the pile, not for the person buying one. See pricing for setup that includes the controls, or book a demo and try one normal sale, then a stack past the limit.
A bulk buy that does not match the rest of the day
One person asks for a stack of cards while everyone else is buying one. It might be a company gift. It might be the start of a drain. The tell is volume that does not match the day, a rush to pay, or a wish to skip the normal activation. Activate only at purchase so a blank card from the rack is worth nothing until this sale finishes. Set a bulk limit and make the override a manager step. For cards sold online, use the same care as other card-not-present fraud, because a digital code is easy to move. Watch balance checks that arrive in a burst. A normal guest checks once. The closer should still sell a single birthday card with no speech about fraud. See pricing for setup that includes those controls.
Controls that sit behind a normal sale
Activate at the till, keep numbers long, cap bulk buys, and watch balance checks that arrive in a burst. A guest buying one birthday card should not feel any of that. The card gets value when they pay. The number is not a short code someone can guess. A pile of cards hits a limit. A script hammering the balance page gets slowed down. PINs and rate limits are the technical half. The human half is a specific staff rule: call a manager for a bulk amount, and do not read a balance to a stranger who claims to be from corporate. Keep the selling motion easy, as in gift cards 101, while the controls stay on. Book a demo and try a repeated balance check, then a stack past the limit.