Julia Morgan was at the Costco checkout when her $500 Prezzy Card unexpectedly declined – even though she hadn’t spent any of the money.
“It declined and I was quite shocked I think at first,” the Auckland mum said. “The second time round I thought I’d try again – and it declined.”
When Morgan checked the card balance online later, she was stunned to find the money had almost completely vanished.
The transaction history showed more than 100 small charges, all made on the same day within minutes of each other, for purchases listed simply as “Google” and “TikTok”.
How scammers are draining gift cards before they’re even opened - Watch on TVNZ+
James Stringer, from Dunedin, can relate to the confusion. His $200 Prezzy Card, which he received as a Christmas gift, was drained to just $6.36 before he had a chance to use it.
In both cases, the cards were unopened and still sealed in their original cardboard packaging.
“It's not like someone has taken the card, copied the numbers from the card and then used the card,” Stringer told 1News. “The details have been either stolen or leaked.”
Where did the money go?
The cards were likely targeted by online cyber fraudsters. 1News can reveal the gift card company was hit by two large‑scale cyber attacks earlier this year – known in the payments industry as “BIN attacks”.
In such attacks, criminals target ranges of card numbers issued by a provider, using automated systems to identify active cards and drain funds through a series of small online purchases.
Roger Smith, regional managing director of epay Australia and New Zealand – which operates Prezzy Card – confirmed the company blocked 31,000 fraudulent transactions during the first attack on New Year’s Day.
A second attack, on Sunday, stopped a further 38,000 similar attempts.
However, some transactions still got through, which explains why some customers found their card balances wiped out.
Smith said around $7000 had been reimbursed to customers so far as a result of the two attacks, with the company’s usual 60-day dispute window waived for these cases.
Criticism over communication, security
Consumer NZ has criticised Prezzy Card for failing to directly notify customers of the breach.
“That would avoid the situation of people trying to use their card and finding they have been scammed,” Consumer NZ communications and campaigns manager Jessica Wilson said.
Customers are being urged to regularly check their card balances and contact Prezzy Card, which will handle refunds.
Auckland University cybersecurity expert Abhinav Chopra said prepaid cardssuch as Prezzy do not have the same levels of fraud protection as traditional bank accounts.
“Prezzy appears to have kept up reasonably well on the consumer convenience side, particularly with digital wallet support,” he said.
“The biggest question is whether the back‑end fraud controls have kept pace with the current threat environment.”
However, Smith said the company’s security systems were “as strong as they can be”, and it was working with police, Visa and other agencies to fend off further cyber-attacks.
“Prezzy card holders are our first priority and will always be looked after if they have been subjected to fraudulent activity,” he told 1News.
SHARE ME