Gift Card Cyberattacks Raise Security Concerns for Reward and Recognition Programs
What Corporate Buyers Should Do Now
What Is Happening in the Gift Card Industry?
Could Merchandise Reward Catalogs Face the Same Threats?
Security Becomes Another Measure of Supplier Value
Click here to subscribe to the ESM weekly e-newsletter.
.png)
What happens when a company awards thousands of dollars in gift cards or merchandise rewards, only to discover that the supplier's systems have been hacked, the rewards cannot be delivered, or the value has been stolen? Recent cyberattacks and transaction disruptions affecting the gift card industry, including incidents publicly reported by Bidali and service interruptions documented by Tillo, bring this risk into sharper focus. With corporate incentive, recognition, and loyalty programs increasingly dependent on interconnected digital platforms, a security breach at one supplier can potentially disrupt rewards for thousands of recipients. And while digital gift cards may be particularly attractive to criminals because of their immediate liquidity, merchandise reward catalogs are not immune. For corporate buyers, the incidents raise urgent questions about supplier security, financial liability, and what happens when a reward cannot be delivered. For the gift card industry, it means a new reality created by AI: the ability to launch ever changing attacks by multiple agents at incredible speeds.
According to a gift card market executive who preferred to remain anonymous, this is a broad AI-powered attack aimed at the entire business-to-business gift and e-card marketplace, with a focus on broadly accepted cards and e-codes and particularly for gaming products and services. “We always assumed that the retail market was the most vulnerable, so this attack on the business sector came as a surprise.” This gift card executive said her company was attacked as well, but that its specific category does not involve major retail products, has strict daily purchase limits, and does not involve the aggregation of multiple-cross channel API-connections most vulnerable to attack. She added, “We must assume that this is not a one-time assault. All companies in this space now must be especially vigilant and expect continued efforts by AI agents to find vulnerabilities. I suspect that some aggregators will have to make major changes in their infrastructure and potentially even their business models.”
What Corporate Buyers Should Do Now
Organizations purchasing gift cards or merchandise rewards should ask their suppliers five basic questions:
1. Who actually fulfills the rewards? Determine whether the supplier relies on third-party issuers, distributors, or fulfillment companies and what happens if one experiences a security incident.
2. Who is responsible for losses? Contracts should clarify liability for unauthorized transactions, stolen reward balances, undelivered gift cards or merchandise, and compromised accounts.
3. What security protections are in place? Ask about multifactor authentication, API security, transaction monitoring, spending limits, and the ability to suspend suspicious activity immediately.
4. What happens when systems go down? Suppliers should have backup fulfillment arrangements and procedures for notifying clients and participants.
5. Are reward balances and participant information protected? Buyers should understand how funds, points, personal information, and redemption credentials are secured.
These questions apply to merchandise catalogs as well as gift cards, although the vulnerabilities are not identical.
What Is Happening in the Gift Card Industry?
On Oct. 23, 2026, digital gift card provider Bidali reported that several issuing partners had notified it of cyberattacks, prompting the company to suspend gift card operations as a precaution. Bidali also disclosed a separate intrusion into its own administrative systems, which it said resulted in relatively limited financial losses.
Meanwhile, Tillo's public status reports documented multiple transaction interruptions affecting prepaid products and retail brands during October. These disruptions do not necessarily mean Tillo itself was hacked, nor has every interruption been publicly attributed to a cyberattack. Nevertheless, the incidents demonstrate how problems at one point in the distribution network can affect numerous reward providers and corporate customers.
"In my 27 years in the industry, I have never seen such a consolidated, focused, systematic attack in such a short window of time that has affected not just one company, but an entire sector," says Eric Thiegs in a recent Linkedin post. He is head of strategy and growth for Neocurrency, a Los Angeles-based international gift card distributor. He is also Executive Vice President of the Incentive Gift Card Coalition, an Incentive Marketing Association special interest group.
Despite these widespread cyber threats, the industry appears to be responding with unprecedented collaboration. Through initiatives like the Incentive Gift Card Coalition (IGCC), Thiegs recommends that the industry unite to share root-cause analyses, establish a secure work-share group for real-time attack vector notifications, and host open forums—reinforcing that when it comes to combating digital fraud, rising tides lift all boats.
The concern extends beyond temporary outages. Gift cards are attractive to criminals because they represent purchasing power that can often be transferred, redeemed, or resold quickly. According to Fortra's September 2026 Business Email Compromise Global Insights Report, gift cards accounted for 46.9% of the cash-out methods observed in its business email compromise investigations. That figure reflects Fortra's sample of attacks, not the overall incidence of gift card fraud.
Could Merchandise Reward Catalogs Face the Same Threats?
Merchandise reward catalogs are also vulnerable to cyberattacks, particularly when they rely on online redemption platforms, points banks, automated ordering, and APIs connecting multiple suppliers, but the risks are somewhat lower because of several factors. Criminals who gain access to administrative accounts or participant credentials may be able to redirect merchandise shipments, manipulate points balances, or place fraudulent orders.
On the other hand, merchandise generally presents different fraud risks from digital gift cards. Physical products require inventory, shipping addresses, and delivery arrangements, creating additional opportunities to identify suspicious transactions or intercept fraudulent orders. Gift cards, by comparison, can often be delivered electronically and redeemed almost immediately, potentially making stolen value harder to recover.
Merchandise catalogs are not immune to rapid fraud. Attackers can target high-value electronics and other easily resold products, while compromised fulfillment systems can expose customer information or disrupt shipments. Digital merchandise vouchers and automated drop-shipping arrangements may face risks closer to those of gift cards. The distinction is important for companies offering both merchandise and gift cards through integrated reward platforms. A breach of a shared account-management system, points ledger, or redemption platform could affect both categories, even though the methods used to extract value differ.
Security Becomes Another Measure of Supplier Value
For corporate reward and recognition buyers, the lesson is not to abandon gift cards or merchandise catalogs. Both remain valuable components of incentive, recognition, and loyalty programs. Rather, the recent incidents underscore the importance of evaluating suppliers on more than brand selection, discounts, technology integration, and fulfillment speed.
The FBI's guidance on business email compromise also highlights the danger of fraudulent requests to purchase gift cards for employee rewards, demonstrating that threats can arise within the corporate buying process itself, not just at the supplier. As digital rewards become increasingly automated and interconnected, cybersecurity, financial safeguards, and business continuity should become standard criteria in supplier selection. For the incentive, reward, and recognition industry, protecting the value of a reward is as important as delivering one that recipients want.
Enterprise Engagement Alliance Services
Celebrating our 17th year, the Enterprise Engagement Alliance helps organizations enhance performance through:1. Information and marketing opportunities on stakeholder management and total rewards:
- ESM Weekly on stakeholder management since 2009. Click here to subscribe; click here for media kit.
- RRN Weekly on total rewards since 1996. Click here to subscribe; click here for media kit.
- EEA YouTube channel on enterprise engagement, human capital, and total rewards since 2020
Management Academy to enhance future equity value for your organization.3. Books on implementation: Enterprise Engagement for CEOs and Enterprise Engagement: The Roadmap.
4. Advisory services and research: Strategic guidance, learning and certification on stakeholder management, measurement, metrics, and corporate sustainability reporting.
5. Permission-based targeted business development to identify and build relationships with the people most likely to buy.
Contact: Bruce Bolger at TheICEE.org; 914-591-7600, ext. 230.
