A Warning about electronic gift cards and gift card sites!!

[ellie05]

I too, usually use right away. This time I happened to wait 5 days. BUT these supposedly were an issue with Target and not cardpool. So even adding them to your Target account, you are not safe. I read another woman's post that changed her third party cards into a physical target card, but because she add it to her target account, it got drained. There are so many possibilities, that's the problem. Hearing about all the compromised Target accounts, I am leaning towards that. However, how is it not possible that an employee at Cardpool sold the email? Who knows!

Thank you OP for posting this. I was going to consolidate all my gc into one big one, but I was going to order 3 separate orders and space them out. Now I am going to put them in 3 different gc so I don't leave the gc link to my account.

 

[mickeyhereicome]

Interesting - Cardpool hypes their "100 day purchase guarantee" but you have to dig into their Terms of Service to see that they don't actually cover electronic gift cards with that guarantee. I hate companies that play that game!

Here's what it says on their Purchase Guarantee screen - which is what most people would be going by:

Cardpool is committed to making our customers happy by offering the highest level of service possible. If you are not satisfied with your Cardpool purchase for any reason, you may return your unused gift card for a full refund*. If you purchase any gift card from Cardpool, we guarantee it will be valid at the merchant and to the dollar amount specified on your order. We make such guarantees for up to 100 days from the date of your purchase, up to a maximum of $1000 per customer.
* Return policy does not apply to electronic gift cards or mobile gift cards due to the nature of the program. The Cardpool Purchase Guarantee is subject to the terms and conditions in our Terms of Use Agreement.

(Note it says the Return policy does not apply to electronic gift cards, but they don't say anything about the validity guarantee not applying. I believe the company is being PURPOSELY misleading in this regard, given the terms of service below.)

But then here's what's buried in the Terms of Service:

PURCHASE GUARANTEE PROGRAM DOES NOT APPLY TO ELECTRONIC GIFT CARDS OR MOBILE GIFT CARDS DUE TO THE NATURE OF THOSE PROGRAMS.

OP, I am sorry for your pain, but I appreciate you calling this out. I WILL NOT be purchasing cards from Cardpool anymore. I tended to purchase electronic cards, but thought they would be covered by the value guarantee.

If you used your credit card to make the purchase, dispute the charge. There's a good chance the credit card company will side with you. You might get black-balled from Cardpool as far as future purchases, but who cares - they aren't a company worth doing business with.

Yes I did all this research as well, and was told this as well. If you read through their terms of use, the have a clause that states sellers of gift cards will not use the cards after they send them to cardpool and if they do, they will be charged the amount the buyer paid plus a $10 service charge. This makes you believe they store the sellers cc. However, cardpool is claiming they have nothing to do with it because the 14 electronic codes came from more than one seller.

 

[StuckInKS]

That is awful. I try to only load my cards into target at the same time I am going to use them. Hopefully that will prevent this happening to me. So sorry

Me too, but not because of this, as I didn't even know about this risk. This will probably deter me from purchasing from Carpool, however it does sound like this is a Target issue with all the reports of cards purchased directly at target being drained off of the app/website. Although I use my Raise GCs immediately and don't input my physical GC numbers into the Target website until I'm ready to purchase, I do hold on to emailed eBay GC codes from Target until an ebucks deal or coupon rolls around. Hopefully those aren't at risk too

 

[minorthr]

That really stinks. I usually use the cards with in minutes of getting them and so far knock on wood haven't had any issues with cardpool. Hopefully you get some relief from your credit card company.

 

[DisneyBill]

If this is as common as outlined, and is specific to Target electronic gift cards, then I would think Cardpool should do the right thing for their buyers and their own reputation and stop selling Target electronic gift cards.

 

[StuckInKS]

That really stinks. I usually use the cards with in minutes of getting them and so far knock on wood haven't had any issues with cardpool. Hopefully you get some relief from your credit card company.

If this is as common as outlined, and is specific to Target electronic gift cards, then I would think Cardpool should do the right thing for their buyers and their own reputation and stop selling Target electronic gift cards.

The biggest issue is that its not just Cardpool. It seems to be Target's electronic GCs in general (even ones purchased from Target) that are at risk. This particular victim just happened to buy her cards from Cardpool. If Cardpool refunded OP's money, they would probably take it from the people who sold them the GCs and its not their fault either. Hopefully, those who are getting their Target cards drained will complain enough that Target will spend the $ to fix their security issue. It is probably wise for everyone to use all Target GC codes promptly after buying them and not load their physical GCs into Targets system until they are ready to use them (apparently, based on this story, not even to check the balance). I'm hoping third-party GC codes sold by Target's website are safe, because most of us sometimes hang on to them awhile.

 

[MarlaSingersLaundry]

Wow, I am really sorry this has happened to you. It does sound like possibly an issue w Target rather than card pool. I've been using card pool for physical cards. I will take your warning though. Good luck. I hope your credit card company will reimburse you.

 

[BonnieA]

I use the discount gift card sites a lot. But I only get physical gift cards. I'm sure I could be just as vulnerable but as yet I've been luck.

 

[MomToOne]

I'm not so willing to believe this is a Target problem - hacking a system is not trivial work, and with Target's history they are on high alert. Could it have happened? Sure. Is it the most likely scenario? Hardly.

The other common methods of gift card theft - such as stealing the number off the card at the store, then waiting for it to be activated - wouldn't account for cards from 14 different sellers that were presumably purchased from many different locations being stolen at one time, in one group.

I think there is a very real possibility that someone at Cardpool simply copied the gift card numbers before sending them out, and then forwarded or sold them to someone else to use. They have a number of people who see the gift card numbers and PIN codes before they are sold - when it first comes in from a seller, someone verifies the balance so they have access to the info. Then someone checks the balance again before sending it out to the buyer. And who knows who has access to it in between. And at each of these steps, all it takes is a piece of paper and a pen to write down the gift card number and PIN to steal it.

The most likely point of theft is the easiest point of theft. In this case, that's at Cardpool.

The only other reasonably likely point of theft in this case (if indeed there truly were 14 different sellers of the original cards - I wonder how true that is) would be if the thief managed to get the OPs email password and hacked that account, or their Target userid and password and hacked their individual Target account as opposed to hacking the entire Target system. This is definitely possible if one site you used was hacked in a large breach and someone got your userid and password, and you tend to use the same userid/passwords on many sites. Thieves will often try many websites with stolen userids/passwords because of the tendency we all have to reuse the same ones over and over. I'll have to leave it to the OP to determine how likely this scenario is. But I still believe it is less likely than someone at Cardpool just copying all the numbers, because it takes a much greater level of sophistication. Plus if I remember right, the Target system doesn't show the whole gift card number or PIN that is loaded, just a few of the numbers and the amount - so I don't think hacking the OPs Target account would even be enough to steal the giftcard numbers. But I admit I'm having problems logging onto Target right now to verify that.

(And for those of you that think physical gift cards are safer - the next time you have one, try to lift that little silver sticker that covers the PIN code off of your card. It comes up in one clean piece, if you carefully remove the actual sticker instead of scratching it. You can then read the PIN, and put the sticker back in place, making it look like it was never read. You can even buy the scratch-off stickers on eBay! All anyone has to do is steal a bunch from a store, take them home and record all the numbers, then plant them back on the store shelves. Once they are activated - jackpot!)

 

[Marionnette]

I'm not so willing to believe this is a Target problem - hacking a system is not trivial work, and with Target's history they are on high alert. Could it have happened? Sure. Is it the most likely scenario? Hardly.

The other common methods of gift card theft - such as stealing the number off the card at the store, then waiting for it to be activated - wouldn't account for cards from 14 different sellers that were presumably purchased from many different locations being stolen at one time, in one group.

I think there is a very real possibility that someone at Cardpool simply copied the gift card numbers before sending them out, and then forwarded or sold them to someone else to use. They have a number of people who see the gift card numbers and PIN codes before they are sold - when it first comes in from a seller, someone verifies the balance so they have access to the info. Then someone checks the balance again before sending it out to the buyer. And who knows who has access to it in between. And at each of these steps, all it takes is a piece of paper and a pen to write down the gift card number and PIN to steal it.

The most likely point of theft is the easiest point of theft. In this case, that's at Cardpool.

The only other reasonably likely point of theft in this case (if indeed there truly were 14 different sellers of the original cards - I wonder how true that is) would be if the thief managed to get the OPs email password and hacked that account, or their Target userid and password and hacked their individual Target account as opposed to hacking the entire Target system. This is definitely possible if one site you used was hacked in a large breach and someone got your userid and password, and you tend to use the same userid/passwords on many sites. Thieves will often try many websites with stolen userids/passwords because of the tendency we all have to reuse the same ones over and over. I'll have to leave it to the OP to determine how likely this scenario is. But I still believe it is less likely than someone at Cardpool just copying all the numbers, because it takes a much greater level of sophistication. Plus if I remember right, the Target system doesn't show the whole gift card number or PIN that is loaded, just a few of the numbers and the amount - so I don't think hacking the OPs Target account would even be enough to steal the giftcard numbers. But I admit I'm having problems logging onto Target right now to verify that.

(And for those of you that think physical gift cards are safer - the next time you have one, try to lift that little silver sticker that covers the PIN code off of your card. It comes up in one clean piece, if you carefully remove the actual sticker instead of scratching it. You can then read the PIN, and put the sticker back in place, making it look like it was never read. You can even buy the scratch-off stickers on eBay! All anyone has to do is steal a bunch from a store, take them home and record all the numbers, then plant them back on the store shelves. Once they are activated - jackpot!)

So, how do you account for people having all of their Target GCs being wiped out when they were entered into the app? Some of those people had a combination of eGCs from rewards sites, physical GCs from merchants and eGCs purchased from websites like Cardpool. The only common denominator was the Target app.

 

[ellie05]

I'm not so willing to believe this is a Target problem - hacking a system is not trivial work, and with Target's history they are on high alert. Could it have happened? Sure. Is it the most likely scenario? Hardly.

The other common methods of gift card theft - such as stealing the number off the card at the store, then waiting for it to be activated - wouldn't account for cards from 14 different sellers that were presumably purchased from many different locations being stolen at one time, in one group.

I think there is a very real possibility that someone at Cardpool simply copied the gift card numbers before sending them out, and then forwarded or sold them to someone else to use. They have a number of people who see the gift card numbers and PIN codes before they are sold - when it first comes in from a seller, someone verifies the balance so they have access to the info. Then someone checks the balance again before sending it out to the buyer. And who knows who has access to it in between. And at each of these steps, all it takes is a piece of paper and a pen to write down the gift card number and PIN to steal it.

The most likely point of theft is the easiest point of theft. In this case, that's at Cardpool.

The only other reasonably likely point of theft in this case (if indeed there truly were 14 different sellers of the original cards - I wonder how true that is) would be if the thief managed to get the OPs email password and hacked that account, or their Target userid and password and hacked their individual Target account as opposed to hacking the entire Target system. This is definitely possible if one site you used was hacked in a large breach and someone got your userid and password, and you tend to use the same userid/passwords on many sites. Thieves will often try many websites with stolen userids/passwords because of the tendency we all have to reuse the same ones over and over. I'll have to leave it to the OP to determine how likely this scenario is. But I still believe it is less likely than someone at Cardpool just copying all the numbers, because it takes a much greater level of sophistication. Plus if I remember right, the Target system doesn't show the whole gift card number or PIN that is loaded, just a few of the numbers and the amount - so I don't think hacking the OPs Target account would even be enough to steal the giftcard numbers. But I admit I'm having problems logging onto Target right now to verify that.

(And for those of you that think physical gift cards are safer - the next time you have one, try to lift that little silver sticker that covers the PIN code off of your card. It comes up in one clean piece, if you carefully remove the actual sticker instead of scratching it. You can then read the PIN, and put the sticker back in place, making it look like it was never read. You can even buy the scratch-off stickers on eBay! All anyone has to do is steal a bunch from a store, take them home and record all the numbers, then plant them back on the store shelves. Once they are activated - jackpot!)

There are fantastic hackers out there. I personally had an e gift card bought from target send to my sister drain before she used it. Could they have hack her email ? Sure but if they did that wouldn't they take the Amazon gc info that my mom send her ?

I had my computer hacked a year ago. The weirdest part is that they wipe it and then left all the files in a folder. I spend hours with Mac geniuses who found this fascinating and couldn't believe it. They were all floored that the files were left in the computer because not only did it take someone really experience to do that, but software for such things cost thousands of dollars.

We don't know for sure that it was target in this particular case, but the target website is not the most secure.