R. Paul Wilson On: Gift Card Scams and TITO Loopholes

Author: R. Paul Wilson

Gambling can expose us to new vectors of deception as con games constantly evolve to target various groups. A key factor of who scammers target is “who’s got money,” but another is “who spends that money,” and since players are constantly moving resources in and out of accounts and casinos, we (gamblers) might be more vulnerable to potential attack.

That being said, smart players tend to be tough marks who are harder to fool with jam auction scams or other common con games since the average smart gambler knows more tricks than the average member of the public, though, as we’ve discussed elsewhere, that knowledge might be used against us by clever hustlers. It’s therefore wise to maintain an interest in cons and scams, so we might recognize one in the future or even predict one that has yet to happen.

The Gift Card Scam Rampant across America

Every year, I pay a little extra attention around the holidays to see what scams are most reported by the media and at the end of 2023, one particular con game seemed to be everywhere as news reporters replicated each others’ on-air pieces about a gift card scam that was seemingly running rampant across the United States of America. If you watched the news anywhere in the States, you probably saw these reports, and if you’ve ever played modern slot machines, the gift card trick might seem quite familiar.

Let’s quickly examine what was happening in stores. Victims were collecting packaged gift cards from stores and loading them with money before gifting them to friends and family who later learned the cards had been drained. How could this happen, you ask? The cards were on open display, easy to steal and return once the thieves had retrieved the barcode data within.

There are variations on procedures for each type of gift card, but typically, there’s a barcode on the back of the card that’s either hidden by packaging or contained under a scratch-off surface, so all a criminal needs to do is take as many unused cards home as they can steal, pry open the protective layer, record the barcode and any other necessary data, re-seal it inside then reverse-shoplift those cards back onto the shelf! By tracking these cards online, whenever a victim adds funds to a compromised card, the scammers use the stolen barcode information to redirect or spend the cash before the recipient opens their holiday envelope.

I watched a lot of news reports, which were suspiciously similar - like wild animals picking up a new trick: Once one monkey knows how to use a can opener, pretty soon every monkey will be eating fruit cocktails and beans. The gift card trick was easy pickings for lazy journalists, and while I’m all for the media warning the public of potential dangers, this was too little, too late.

It annoys me that the press shows little interest in potential scams until they become a bigger problem like casino hacking and personal information protection, this is a major factor in how many con games succeed for so long. Like many con games, the gift card scam became too popular to be ignored, so it overflowed into the wider consciousness. In fact, variations on this scam have been around since we were making “The Real Hustle” TV show and probably since gift cards first appeared.

The people who make these cards have long known they might be compromised but have done little to protect people until now since the losses - which are borne almost entirely by the customer - have become impossible to ignore.

Gaming the System – Exploiting TITO Loopholes in the Casino Industry

This swindle also relates to the gaming industry, where Ticket In and Ticket Out systems manage payment between slot machines by printing vouchers that are equivalent to cash when redeemed by the player, and the way these TITO systems operate affords many opportunities for criminals to exploit casino weaknesses and take advantage of flaws in the procedure.

A simple but effective strategy is to watch for players hitting ‘cash out’ for large amounts on a machine that delivers multiple tickets to cover those amounts. I haven’t seen this personally, but I have read reports from several players who walked away with the first voucher they received, only to learn it was for much less than expected.

Returning to the machine, they find the second voucher was already swiped, meaning they’re out of luck and out of pocket in a matter of seconds. What’s disappointing is that players who wrote about this said that staff in some land-based casinos already knew about it and offered no help to recover the money or even identify who swooped in to steal the ticket.

TITO systems might make gaming floors easier to manage and more pleasant to be in (I still have 1980s coin hoppers rattling in my ears), but if it’s not mutually beneficial for the players as well as the house, the bottom line might be impacted when scams grow exponentially as they have with the gift card bandits in Target and Walmart.

Innovative Scams in the Age of Advancing Technology

As technology improves, new opportunities for scammers are bound to appear. A common TITO scam was to photocopy barcodes and then claim the cash for the original voucher either from a cashier or floor attendant, immediately using the photocopied barcode on another machine to print out a fresh voucher code.

This only worked if there was a delay between paying out the original voucher and validating/updating that ticket on the system, so most casinos have closed this loophole, but with the recent chaos in Las Vegas caused by global hacking attacks and property transfers, I’ve seen multiple places where delayed TITO scams might still work.

Crooked Slot attendants and maintenance staff have also used TITO to run up large amounts via offline machines before reconnecting those machines (or just their motherboards) to the network and printing a valuable ticket. Versions of this procedure can be performed on tiny devices using stolen hardware repackaged and repurposed to crank out random amounts and collect “free money”.

A low-tech method is to simply insert a device that stops vouchers from being ejected, and when players go to find help, the device and the trapped ticket are quickly retrieved, but I doubt this would fool anyone familiar with the “Lebanese Loop” scam, which uses a similar contraption to trap bank cards inside an ATM after the PIN code has been recorded (via hidden camera or good old shoulder-surfing).

Similarly, knowing a con that targets customers in a department store can protect players on a casino floor. And vice versa.

Defending against Deceit

The fact is that anyone with a mind for trickery would have spotted how gift cards might be vulnerable (as we did on Real Hustle over a decade ago); we can also see how TITO systems - where tickets are not correlated with player cards - might be compromised by hidden cameras and pocket-sized printers where a scammer wearing consumer technology can capture any barcode he sees and have the software automatically print that exact barcode on a duplicate ticket and simply get to cashier first - or better yet, transmit the data to a confederate already in line to cash out.

Frankly, the possibilities are endless, but once they become as easy and as accessible as gift card scams have for lazy, scumbag criminals, expect to hear all about these scams from a rash of equally lazy journalists lining up to close the barn door after the horses are long gone.

True grift sense is the ability to spot scams before they happen and recognize them before they target you, and all it takes is knowledge, an interest in deception (and how it works), and the ability to think before you act.

I happened to be in a store with a rack of gift cards on display, so I decided to see how many different types there were in terms of packaging and protection. Scratch-off layers looked to be the most effective (though one can buy scratch-off stickers to replace any you might have removed), but those where the data was contained inside the cardboard outer layer looked extremely easy to open and re-seal and, in fact, I found a dozen that looked like this had already happened! Sending cash might be safer…