Gift card fraud controls are becoming a state-by-state operational problem for retailers, prepaid program managers and packaging suppliers. Maryland now requires physical safeguards and employee training, California has expanded consumers’ right to cash out small balances, and New York lawmakers are considering a separate packaging and record-keeping regime.
The measures address different risks and are at different legal stages. That distinction matters for national programs: Maryland’s requirements are in force, California’s higher redemption threshold took effect April 1, and the New York proposal has passed the state Senate but is not law.
A new Javelin Strategy & Research report frames the broader trend as a choice between hardening cards and packaging or pursuing perpetrators through criminal penalties. Its public summary says 20 states will have gift card fraud laws in effect by the end of 2026. PaymentsJournal highlighted the resulting compliance fragmentation on September 21.
Maryland moved fraud controls into the retail aisle
Maryland’s Gift Card Scams Prevention Act puts obligations on the physical product and on the merchant selling it. For in-person sales, the enacted law requires covered open-loop cards to use packaging that shows evidence of tampering, conceals activation or redemption data such as PINs and CVV numbers, and carries a warning not to sell or buy a package that appears compromised.
The law also addresses closed-loop cards, subject to specified exceptions, and requires merchants displaying covered cards to train employees whose regular duties include gift card sales. The training requirement is important because packaging alone does not resolve every point of failure. Staff still need a process for identifying altered packs, responding to suspicious purchases and escalating customer reports.
Maryland also created record-retention duties for certain third-party resellers and gave its consumer-protection division responsibility for model notices and fraud guidance. The principal packaging provisions became effective October 1, 2025. For multistate retailers, that means Maryland is not merely a design benchmark; it is an active compliance jurisdiction.
California increased the cash-out obligation
California Senate Bill 22 took a different route. The enacted measure raised the mandatory cash-redemption threshold from balances below $10 to balances below $15 and expressly expanded the statutory definition to include electronic gift cards. The change became operative April 1, 2026.
The rule gives consumers a way to recover small residual balances rather than leave them stranded. It also changes store procedures. Retailers need systems that can identify eligible balances, refund them accurately and distinguish covered cards from statutory exceptions. Frontline instructions and cash-handling practices must match those system rules.
Javelin analysts told PaymentsJournal that a higher threshold could create additional theft or cash-management exposure if bad actors aggregate cards with redeemable balances. That is an analyst warning, not a documented finding that California’s change has caused more fraud. Operators should separate the verified legal duty from the forecasted risk and monitor their own refund patterns before drawing conclusions.
New York proposal remains pending
New York Senate Bill S704A would require gift certificates sold in person to conceal visible numbers used for balance inquiries or manual redemption, unless the product uses technology designed to prevent activation after tampering or to stop unauthorized redemption. It would also require employee training and impose three-year record-keeping requirements on third-party resellers of open-loop cards.
The Senate passed the amended bill on June 3, 2026, and delivered it to the Assembly, where the official action history shows a referral to the Consumer Affairs and Protection Committee. The record does not show Assembly passage or approval by the governor. Businesses should therefore treat it as a proposal, not a current New York requirement.
The official amended text lists September 1, 2026 as its effective date, even though the measure had not completed the legislative process by that date. PaymentsJournal separately reported that manufacturers would have 180 days if the proposal passed. Because those timing descriptions do not align, firms should not build an implementation calendar around either one without checking the final enacted text, if any.
A single national design may exceed the law but simplify controls
The fragmented approach creates decisions beyond legal interpretation. Issuers and packaging vendors must decide whether to produce state-specific stock or adopt the strictest workable design nationally. Retailers need to map which party controls packaging, activation, balance inquiries, refunds, staff training and reseller records. Contracts should allocate responsibility for each function rather than assume the issuer or merchant owns the entire control chain.
Program managers should also test whether fraud monitoring connects the physical and digital stages of a card’s life. Useful signals can include repeated balance checks before sale, activation followed by rapid redemption, clusters of cash refunds, unusual manual-entry activity and customer complaints tied to a store, card range or packaging batch. Packaging can make tampering harder to hide, but monitoring is still needed after activation.
The key accountability issue is whether each participant can detect and investigate abuse at the point it controls. A merchant may see altered packaging, an issuer may see suspicious balance inquiries, and a processor may see rapid redemption. If those signals remain isolated, compliance with a packaging rule can coexist with an unresolved fraud channel.
For national operators, the immediate task is a jurisdiction-by-jurisdiction control inventory: identify rules already in force, distinguish pending bills from enacted law, verify cash-redemption logic, confirm packaging specifications and document employee training. The policy split is real, but so is the risk of turning proposals or analyst forecasts into operational requirements before the legal record supports them.