In an eleven-week stretch of 2025, a shared warehouse in Amherst, New Hampshire took delivery of more than 31,000 Apple devices worth roughly $35 million. Every one had been bought with stolen gift card balances.
Federal agents intercepted 2,000 devices in transit that August. Three men were sentenced. Victim restitution claims covered thefts from October 2023 through September 2025.
Now the question that matters here: in which retailer's loss reporting does any of that appear?
This edition is about the only major loss category that is simultaneously growing, federally prosecuted, legislated in a dozen states — and completely absent from every instrument the LP function owns.
The crime is industrial
Gift card draining is not a scam in the consumer-education sense. It is a supply chain.
A runner takes cards off the rack, tampers with the packaging to capture the redemption code, and returns them to the J-hook. The card sits there looking untouched. A customer buys it and loads it. The balance is drained within minutes, often before the recipient opens the envelope.
Roughly 100 arrests in eighteen months under the HSI-led federal effort known as Project Red Hook, with an estimated thousand more runners still operating. The going rate for the work: 30 cents per card returned to the rack. One runner was found holding $60,000 in tampered cards (ProPublica, 2024).
In March 2026, Michigan's Attorney General charged a California man with Conducting a Criminal Enterprise — a 20-year felony — over cards planted across six Meijer stores.
In November 2025, a defendant in South Florida pleaded guilty after targeting some 42 grocery stores across five counties.
This is organized, transnational and prosecuted federally. It is also entirely absent from the instrument this industry uses to measure loss.
The number everyone quotes is the wrong number
One correction first, because this brief does not repeat figures it cannot stand behind.
You have seen the claim that Americans lost $1 billion to gift card draining. The source is ProPublica, and the actual sentence is: "Between 2019 and 2023, Americans lost close to $1 billion to card draining and other gift card scams, according to the Federal Trade Commission."
Three things vanish in the retelling. It is a five-year cumulative total, not annual. It is the FTC's figure for gift cards used as a payment method in any scam — overwhelmingly imposter and tech-support fraud where a victim reads a code over the phone — of which draining is an unmeasured subset. And it counts consumer losses, not retailer losses.
The defensible FTC figures: $212 million across 41,120 reports in 2024, and $198.8 million in the first nine months of 2025 against $158.4 million in the same period of 2024 — a 25.5% increase. More than one in four consumers who reported losing money to fraud said gift cards were involved.
Nobody has ever published a credible national figure for draining specifically. Edition #03 made this argument about ORC. It lands harder here, because ORC at least had a number to inflate.
Why nothing in your P&L flinches
Here is the mechanism, and it explains the silence better than any conspiracy would.
A gift card sale is not revenue. Cash comes in and a liability goes on the balance sheet — deferred revenue, the promise to deliver goods later. When the card is redeemed, the liability is extinguished and revenue is recognized. Inventory leaves against a completed transaction.
Now run a drained card through that. The thief redeems at full face value against a liability you already booked. Goods move. The register balances. Inventory reconciles perfectly, because a legitimate-looking transaction consumed a legitimate-looking balance.
No book-to-physical variance. No shrink movement. No chargeback, because you are not disputing a card network. Apple, Walmart and Target all state in their terms that they are not responsible for lost or stolen gift cards, and ProPublica found more than half of surveyed victims never received a credit or refund.
The loss surfaces in exactly two places: a goodwill reload at the service desk, and the customer who never comes back. Neither is coded to loss prevention.
A perspective from the field
Every loss category this function has ever owned became ours because it left a footprint we could measure. Shrink gave us a variance. Refund fraud gave us a transaction log. Draining gives us nothing, and we have quietly accepted that as evidence it is not our problem.
The absence of an instrument is not evidence that the loss is small. It is evidence that we drew our scope around what was easy to count. A state legislature is now building the data set we never built. That should be embarrassing.
Legislatures got there before retailers did
The 2026 session was remarkable, and the vote margins are the tell.
Georgia created three new offenses — gift card theft, forgery and fraud — signed May 12, effective July 1. Virginia passed HB 662 by 97-0 and 37-0. West Virginia passed HB 4990 95-0, then 34-0. Maryland's SB 437 cleared 45-0 and 120-0. Kansas folded gift cards into its financial-card crime statute in February.
Two go further than criminalization. Maryland's packaging law, effective October 1, 2025, imposes obligations directly on merchants: tamper-evident packaging concealing redemption codes, a point-of-sale warning notice, staff training and three-year record retention, enforced as an unfair trade practice. Six states now impose duties on retailers, not just on criminals.
Colorado's HB26-1138, effective August 12, 2026, creates a Retail Theft Prevention Advisory Board with a statutory mandate to collect and analyze data on gift card fraud. A state is building the denominator because the industry never did.
Legislatures that agree on almost nothing are passing these unanimously.
Three practical moves for the next 90 days
Move the code out of the aisle. Kroger installed locking pegs across 116 stores in one division, forcing cards through a slot so they cannot be lifted and restocked. Target redesigned cards with blank backs and moved code exposure to a security label applied at checkout. Neither has published before-and-after results — which tells you how immature this discipline still is.
Check your exposure to the merchant-obligation statutes. If you operate in Maryland, New Jersey, New York, Delaware, Nebraska or Rhode Island, packaging and training are compliance items with legal consequences, not good practice.
Start counting. Service-desk reloads, customer reports of zero balances, activation clusters by store and hour. It will be a bad, incomplete number. It will also be the only number your company has.
Closing note
Colorado will have gift card fraud data next year. The question is whether you will have yours first.
The pattern in this brief keeps repeating: the categories we measure well get budget and attention, and the categories with no instrument get neither — regardless of what they actually cost. Draining is the cleanest example yet, because the accounting is not merely silent about it. The accounting is designed so that nothing looks wrong.
If your organization has built any visibility into this, I want to see how. Reply with anything you can share, anonymized always.
Forward this to one LP or AP leader who should be reading it.
— Gabriel
The LP Brief is a weekly intelligence read for senior loss prevention and asset protection leaders. Free. No vendor noise.
Not yet subscribed? thelpbrief.com