How Virtual Gift Cards Work

Step 1: Purchase

The process begins when a buyer selects a virtual gift card product — either from a retailer's own website, a banking app, or a specialist gift card marketplace. The buyer chooses:

• The brand or retailer the card is for (or an open-loop network such as Visa)
• The denomination — a fixed amount such as $10, $25, $50, or $100, or sometimes a custom amount within a set range
• The delivery method — usually the recipient's email address, though some platforms allow a link to be shared directly or a PDF to be downloaded
• An optional personalised message to include with the card

Payment is made at this stage by the buyer using a credit or debit card, digital wallet, or other accepted payment method on the issuing platform.

Step 2: Code Generation

Once payment is confirmed, the issuing platform's backend systems generate a unique code — typically a string of letters and numbers, 16–20 characters long. This code is the heart of the virtual gift card. Key technical points about code generation:

• Uniqueness: Every code is unique and is never reused, even after it has been fully spent.
• Cryptographic randomness: Codes are generated using secure random algorithms to prevent guessing or brute-force attacks.
• Server-side storage: The code is securely stored in the issuer's database, linked to the card's value, status (active/spent/expired), and transaction history.
• Activation: In some systems the code is generated in an inactive state and is only activated after payment clears — a security measure to prevent fraud.

Step 3: Delivery

The card is then delivered to the recipient. Common delivery formats include:

• Email: An HTML-formatted email containing the code, the card's value, instructions for redemption, and an expiry date if applicable.
• SMS / text message: A text containing the code and a short redemption link.
• Direct link: A URL that the buyer can copy and share — clicking the link reveals the code.
• PDF download: A printable PDF containing the code and (if applicable) a barcode or QR code for in-store scanning.
• In-app notification: For platforms with dedicated apps, the card may appear directly in the recipient's account wallet.

Delivery is usually near-instant after purchase confirmation, though some issuers may have a short processing window of a few minutes to a few hours, particularly for large-denomination cards.

Step 4: Redemption

Redeeming a virtual gift card is typically a straightforward process at checkout. The recipient:

1. Adds the desired items or services to their cart on the retailer's website or app
2. Proceeds to checkout and selects a payment method
3. Finds the "Gift Card," "Promo Code," or "Voucher" field (the exact label varies by retailer)
4. Enters the code from their email or card display — exactly as it appears, with correct capitalisation
5. Clicks "Apply" or "Redeem" — the system verifies the code and deducts the card's available balance from the total
6. If the card does not cover the full amount, the remaining balance can be paid with another payment method

Partial vs. Full Redemption

Gift cards do not need to be spent all at once. If you use a $50 card on a $30 purchase, $20 remains on the card for future use. This is called a partial redemption. The remaining balance is stored against the code in the issuer's system.

Full redemption occurs when the card's balance reaches zero — at which point the code becomes inactive. It cannot be "topped up" unless the issuer specifically supports that feature.

Step 5: Balance Tracking

After a partial redemption, recipients can usually check their remaining balance by:

• Visiting the issuer's official balance-check page and entering their code
• Logging into their account on the issuer's platform (if the card is linked to an account)
• Calling the issuer's customer service line
• Checking the balance displayed on the confirmation screen after a transaction

Keep a record of your transactions and check your balance periodically — particularly if you have not used the card for a while — to ensure the balance is as expected.

Security Mechanisms

Reputable issuers employ multiple layers of security to protect virtual gift card codes:

Code Complexity

Codes are long and complex enough that random guessing is computationally infeasible. They are generated using cryptographically secure pseudorandom number generators (CSPRNGs).

Rate Limiting

Issuer systems limit how many incorrect code attempts can be made in a given period, blocking automated "enumeration" attacks where a bot cycles through possible codes.

Activation on Payment Confirmation

Many systems only activate a code once the buyer's payment has fully cleared, preventing fraudulent chargebacks from being used to obtain active cards.

One-Time Use Codes

Once a code's balance reaches zero, it is permanently deactivated. Some single-purchase cards are one-time-use regardless of value — once redeemed, the code expires even if the full balance was not consumed (though this is less common).

SSL/TLS Encryption

All communications between the recipient's device and the issuer's server when checking or redeeming a code are encrypted using HTTPS, protecting the code from interception in transit.

Fraud Detection Systems

Larger issuers use automated fraud detection systems that flag unusual activity — such as many small redemptions across multiple accounts — to identify compromised codes and lock them pending investigation.