Key takeaways
- Maryland's "Gift Card Scams Prevention Act," approved in May 2024, targets gift card draining scams and is the first law of its kind in the U.S.
- The law, effective June 2025, mandates secure packaging and visible warnings to prevent gift card tampering, with some exceptions for chip-enabled cards.
- Companies must maintain detailed transaction records for at least three years, subject to law enforcement inspections.
On May 9, 2024, Maryland's governor, Wes Moore, approved the "Gift Card Scams Prevention Act," which is the first law in the nation aimed at targeting the widespread scam known as "gift card draining." Maryland's law comes as no surprise to federal authorities, who, for at least the past 18 months, have actively investigated the role of Chinese organized crime. The U.S. Department of Homeland Security launched a task force, known as "Project Red Hook," to investigate this scam, leading to about 100 arrests, of whom 80 to 90 are Chinese nationals or Chinese Americans. In carrying out these scams, a "runner" steals gift cards, obtains the card numbers and drains the balance, before returning the worthless card to store shelves for later purchase by unsuspecting consumers. A single "runner" – driving from store to store – can swipe thousands of cards or return them after tampering in a very short time.
Generally effective on June 1, 2025, the Maryland law will likely inspire nationwide packaging changes. For in-person sales, the gift card's packaging must conceal or cover all numeric codes (e.g., card number, PIN, barcodes) necessary for redemption, ensuring they are not easily removed or tampered with. Combined with this requirement, the packaging must include a warning label (i.e., "Do not sell or purchase if packaging has been broken or indicates tampering") for sellers and consumers alike.
However, there are exceptions to these requirements. For example, chip-enabled, numberless cards do not share the same vulnerabilities as their counterparts and are therefore exempt. Traditional anti-theft measures (e.g., behind-the-counter sales, anti-theft boxes) also exempt gift cards from the wide reach of Maryland's new law. Notwithstanding these exemptions, the law requires companies to display conspicuous notices. For in-person sales, the notice must be posted at the physical location where the gift card is displayed for sale and, along those same lines, online sellers must display notices on webpages where the gift card is displayed or on the page before the final point of sale.
A model notice from Maryland attorney general's Consumer Protection Division is forthcoming. Companies should expect this notice to warn consumers about scams, instruct them on what to do if they are victimized, and indicate that gift cards should not be used to pay debt.
The Maryland law also imposes recordkeeping requirements on companies, which, as expected, may be inspected by law enforcement at any time. Companies must record and for at least three years retain copies of the following details: the date of the transaction, the name of the person who conducted the transaction, the name, age, and address of the seller of the gift card, and the seller's and buyer's driver's license or identification number. In addition to these requirements, companies must retain a description of the purchased gift card, including the retailer for which the gift card is intended for use, the specific amount issued on the card, the price paid to conduct the transaction, and the signature of the consumer. This information must be chronologically written in ink or logged into a secure database, software system, or other similar technology platform.
Client Alert 2024-199
This article is presented for informational purposes only and is not intended to constitute legal advice.