A number of Costco digital gift card customers are reporting that their cards have been mysteriously drained of all their money.
The big-box retailer has offered few details about what happened, and some affected customers, like Shelly Xu of Perth, Ont., are still struggling to get a refund.
Xu says, in late June, she discovered roughly $200 missing from her Costco gift card, called a Shop card.
“[I] checked my balance and was shocked to find that there were zero dollars on there,” she said. “I was very upset.”
Xu regularly uses Shop cards, because the big box retailer doesn’t accept her Visa credit card.
She says she has spent hours on the phone, and in-person at her local Costco store, trying to resolve the problem. But more than a month after her money disappeared, her case remains in limbo.
“It’s just unacceptable,” said Xu. “They haven’t provided any guidance whatsoever. The only information I’ve been able to dig up has been through online forums where other people have experienced the same issue.”
CBC News found dozens of complaints posted on social media, and on Costco’s online shopping site from people who said the money on their Shop cards had vanished.
CBC interviewed five affected customers from B.C. and Ontario. They said they discovered in June or July that between $150 and $1,000 had been drained from their digital Shop cards.
They also said they found dealing with Costco frustrating, saying the retailer provided little to no information about what went wrong.
Three reported Costco eventually provided a refund, one said she was denied, and Xu is still waiting for a resolution.
“If it was $2.00, I probably would have let this go, but at $200, that’s a good chunk of money that I’m not willing to give up on,” said Xu.
What went wrong?
U.S.-based Costco Wholesale Corporation did not reply to repeated requests for comment.
Consumer advocate and professor Daniel Tsai says he gives the retailer a failing grade for not going public with the Shop card issue.
“Costco has a duty to the public as customers to ensure that they’re aware of any compromise of their gift cards,” said Tsai, a law and business professor at University Canada West in Vancouver.
“From a business perspective, this is a real marketing fail because you’re going to have customers lose trust in the brand,” he said. “The proper thing for Costco to do right now is to admit there’s a problem and not let this fester.”
It appears fraudsters may be responsible for the thefts.
The three customers who got refunds shared with CBC News an identical letter Costco sent them, stating that its “ongoing investigation indicates that a limited number of digital Shop cards may have been used by unauthorized individuals.”
Costco also temporarily suspended online sales of digital Shop cards. According to customer complaints posted on the retailer’s e-commerce site, the retailer halted sales of the cards around July 5 and resumed selling them near the end of the month.
Scammers are finding new ways to deplete money from gift cards ahead of the holidays. Victims of these scams share their stories as cautionary tales. while experts offer tips for how to protect yourself from fraud.
Refund denied
Gift card fraud is big business in Canada. The Retail Council of Canada says that in 2021, Canadians reported $3.8 million dollars in losses due to the crime.
Federal rules mandate Canadians be reimbursed in many cases of credit and debit card fraud. But when it comes to gift card scams, victims are often on their own to battle it out with the company that issued them.
Cybersecurity and tech analyst Ritesh Kotak says that needs to change.
“It is important that we create better mechanisms in place, more protection and also remedies to make people whole that have been victimized by these fraudsters.”
Lisa Mannella of Niagara Falls says, in early June, she discovered $150 missing from her two Shop cards.
She says, in her case, Costco denied her a refund, citing Shop card terms and conditions, which state the retailer isn’t responsible for stolen cards.
“They are such a huge business and they make tons of money,” said Mannella. “For a big company to not even care, or not even offer to help you, that’s pretty sad.”
Mannella says Costco suggested scammers may have accessed her Shop card by hacking her email account, but she’s not buying it.
“They need to take responsibility,” she said. “I suggested to [Costco], ‘Well, maybe your account was hacked.’ And they said, ‘Well, that’s never happened to us.'”
The four other Costco customers interviewed also said the retailer had suggested their email may have been compromised. Costco also hinted at the issue in the letter it sent three of them, by including a reminder to keep their email accounts secure.
One theory
Kotak says it’s possible scammers infiltrated Costco customers’ email accounts.
But he says that because a number of people were affected, it’s also possible that scammers figured out the sequencing of the numbers on Shop cards’ barcodes, and recreated ones that were already in circulation.
“It’s really simple to recreate barcodes. There is software available online,” Kotak said. “You just have to put in the string of numbers, the type of barcode you’re looking for and, with a click of a mouse, you’re able to generate the barcode that you could use in stores.”
Shop card users told CBC News that, to buy goods in-store, the cashier only needs to scan a copy of the barcode; the card’s secret four-digit PIN isn’t required.
The same rules apply for Walmart gift cards. Kotak says retailers likely forgo the PIN requirement in stores, because it makes the shopping experience more seamless.
“Fraudsters are able to leverage this gap — this loophole — to be able to make fraudulent purchases,” he said.
Costco requires its customers to buy an annual membership but, according to its website, non-members can buy goods in-store using a Shop card.
Kotak says that if it turns out the Shop card problem wasn’t the fault of customers, the retailer should compensate all legitimate victims.
“There should be consistency where people are able to get their funds back,” he said. “The last thing you really want to do is re-victimize someone who’s been victimized.”