The Rise of Gift Card Scammers, and How They Work

Last year, we saw the rise of the Twitch streamer “Kitboga”. His style is simple; he phones up scam computer technician companies in order to “get help” with his computer. His “computer” is actually a virtual machine set up so that anything the scammers pulled would do no permanent damage. Kitboga would then stream the results to demonstrate how these scammers operate.

The scammers will pull familiar tricks such as a SysKey scam or infect the target computer with a virus, claiming the effects were due to an expired Microsoft security license. They will then ask for payment to renew this license. This has to be made specifically through gift cards; usually iTunes or Google Play.


Kitboga deliberately stretches the scam out as far as possible in order to waste the time of the scammers. The rationale is that any time spent dealing with him is time not spent scamming actual users. Kitboga has a knack of “hooking” the scammer into thinking they have a chance, leading them on for hours despite never intending to pay them a cent from the very start. Watching his streams does raise an interesting question; why do scammers ask for gift card codes? Isn’t asking for money better?

The Money Problem

Previously, scammers were likely to asked for money to be wired to a bank account. Over the years, the companies that run these money wiring services have become skilled at identifying the patterns of a scammer. If they detect suspicious activity, they swoop in and close down the scammer’s account. No well-meaning service wants to be branded as a cybercrime haven! This is a problem for the scammers, as they ideally want to spend more time scamming and less time setting up new accounts.


This has lead them to adopt the gift card strategy. A bank transfer is troublesome to perform, as transaction logs create a “breadcrumb trail” leading right back to the scammer. A gift card, however, is a lot harder to track. If the scammer asks the victim to purchase a gift card and relay the code on the back over the phone, the transfer isn’t logged at all. This makes it near impossible for anyone to track the scam.

Getting the Gift Cards

The trick is in getting the user to surrender a gift card code. While scammers have moved from money payments to gift cards, their methods of scaring users into paying up haven’t changed much. The scammer puts on the persona of a Microsoft technician, who tells the user their security has expired. They may ask to set up a direct connection to gain access to the victim’s computer, where they then invent their own problem. Once in, they can infect the target with a virus, or lock it behind a SysKey and claim it was the doing of a malware. They then claim they can fix the problem; for a price, all in gift cards.

Once the victim has bought gift cards and given the codes away, the scammer has two choices. They could cash in the code themselves and use it to purchase goods, but this could create a small link between the scammer and the victim. As such, it’s more likely that the codes get sold online for a slight discount to make it more attractive to customers. For example, a $100 gift card could be sold online for $90. The buyer gets $10 “free”, and the scammer gets paid for his work.

The Damage Report


So how much are users losing on average? The answer may be a little higher than you first think. The BBC reports that gift card scams in the UK average out at a £1,150 loss; that’s approximately $1,500 at time of writing. These attacks aren’t just going after chump change; they extract huge amounts of money from unsuspecting victims.

What You Can Do

Thankfully, these kinds of scams are easy to spot. Never, ever obey someone who asks for gift cards for payments. No institute or company will ever ask for payment of services via gift cards. These are only usable on their respective stores, and they cannot gain any monetary value from them whatsoever.

It’s crucial to also inform others who may be susceptible to these kind of attacks. The BBC report for gift card scams state that the majority of victims were 65 years old and above, so be sure to warn any family or friends who you believe may be susceptible.

Gift Grifts

With money-based transfers getting risky for scammers to perform, they’ve turned to the much more discreet gift card method. Thankfully, this opens up an easy way to protect yourself. Never use a gift card for payment outside of the service the card was intended for. No official business will ask for gift card codes.

What do you think of this method of scamming? Let us know below.

Simon Batt Simon Batt

Simon Batt is a Computer Science graduate with a passion for cybersecurity.

One comment

Comments are closed.