His gift card was drained of funds. Getting the money back was a logistical nightmare

As theholiday season begins, a Montreal man is warning shoppers to be cautious about buying gift cards from a third-party retailer.

Rex Miller bought a $500 Home Depot gift card from a Super C grocery store in Brossard, Que., a few months ago. Miller said he bought the card for a friend, but when thefriend declinedit, Millerkept it for himself.

He made two purchases and had a remaining balance of $210.58. But when he tried to use the card again a few weeks later, the cashier told him it was empty.

"I did not use this gift card, nor did I lend it to anyone," said Miller, who had kept the card in a drawer at home in between purchases.

Even more baffling, the protective scratch-off strip that hid the card's number still appeared to be intact.

The small print on the back of his gift card said it was issued by Home Depot Incentives Inc., but there was no contact number.

Miller then spent the next few weeks being bounced around between different Home Depot customer service departments, CashStar, a third-party company that manages Home Depot's gift cards, as well as Super C.

He also filed a complaint with the Canadian Anti-Fraud Centre.

CBCNews reviewed Miller's receipts andemail correspondence with Home Depot.

Chasing answers

Hoping to prove he had not made the purchases, Miller asked for the card's transaction history to see where and when the remaining balance was redeemed.

Due to privacy laws and Home Depot's own security policy, it cannot disclose transaction details to anyone but the police.

The company also told Miller it could only access gift card information on cards bought directly from a Home Depot store or from its website. Since Miller had bought his card at Super C, Home Depot could not find any information related to his card.

"That's something that I think is very weird," said Miller.

Miller contacted Super C, but the grocery chain said it could not help him and directed him back to Home Depot.

Gift cards distributed, managed by intermediaries

Claudiu Popa, a privacy and cybersecurity consultant, said just because the name of a well-known brand is on a gift card, it doesn't mean the retailer produced the card.

"There's a whole ecosystem of vendors who spread that brand around the country," said Popa.

In Home Depot's case, their cards are distributed to other retail locations such as pharmacies, grocery stores and gas stations by a company called InComm Payments.

Popa said the security around gift cards is difficult to control because they are usually displayed out in the open and easy to access.

"They don't know if somebody is going to come by and scratch off the code," said Popa. They don't know if somebody is going to stick another code on top of the existing code on the card. They don't know if someone will take the entire stack of cards, walk away with it, then bring them back after they've been altered."

Consumer protection needed

Gift card fraud is estimated to cost Canadians millions of dollars a year.

Typically, fraudsters are able to obtain a gift card's PIN by peeling or scratching off the protective strip on the back of the card and replacing it with another one. Then they wait to see when a gift card is activated. As soon as the card is loaded with money, the fraudster quickly buys items online.

Once consumers realize their gift card has been compromised, proving who owns itis difficult and it can be hard to know who is responsible when something goes wrong, said Toronto-based cybersecurity analyst Ritesh Kotak.

"If I purchase that gift card with a credit card, would it be the credit card company? Should it be the vendor? Should it be the third party? Should it be the individual that actually sells a gift card to ensure that there is no tampering that occurs with those cards at the point of sale?" said Kotak.

There's no easy answer and Kotak said it's not fair that consumers are left to figure it out.

To combat that, Popa thinks Canada should beef up legislation to better protect consumers.

Currently, federal laws prevent gift cards from expiring and require financial institutions to disclose all fees associated with a prepaid card.

But there is nothing to protect consumers from fraud or unauthorized charges.

In the United States, Popa said there are efforts to broaden the ElectronicFund Transfer Act a federal law that includes consumer protection for various electronic payment systems to include gift cards.

Classifying gift cards under the same rules as debit cards would put pressure on gift card distributors and retailers to better protect the cards by adding security measures such as a chip. This would allow gift cards to be tapped and scanned the same way debit and credit cards are.

"There should be zero risk of these cards being tampered with," said Popa.

He also believes there should be some sort of legal protection built into that legislation, so if a card is compromised, the consumer can easily prove it was not them and be reimbursed.

Gift card reissued

For weeks, Miller tried to get answers about what happened to his money.

Initially, Home Depot's gift card support centre told him it would not be able to issue a replacement because the gift card had been fully redeemed.

Miller provided Home Depot with a receipt that showed he'd bought the gift card with his credit card as well as receipts for the earlier purchases at Home Depot, which showed the outstanding balance.

More than two weeks after he'd first complained, a customer service agent from Home Depot's gift card department confirmed it would reissue a gift card for $210.58, described in an email as a "one-time good faith gesture."

Miller thinks all of this could have been avoided if companies secured their gift cards better. He thinks they should be stored safely behind the counter and recommends people buy their cards directly from the retailer in this case, Home Depot rather than a third party.

How consumers can protect themselves

Popa agrees consumers have a bit more protection if they buy directly from the retailer because it becomes the responsibility of that particular store to sell its own cards and secure them properly.

He suggests buying from recognized brands and activating the card right away, so the buyer can check the balance right up to the day the card is gifted.

"You don't want to give out something that's worthless," said Popa.

WATCH |3 ways to protect yourself from gift card fraud:

How to protect yourself against gift card fraud

5 years ago

Duration 1:31

Reporter Leah Hendry explains how to make sure scammers don't have access to your gift cards.

He also encourages people to find out how to contact the company, so they aren't scrambling at the last moment. Sometimes he even calls the number ahead of time to find out how it will be handled if the card is empty.

"That call tends to be recorded, so I can reference it later on," said Popa.

Although there's something appealing about giving people a physical card, Popa says it's safer to buy gift cards online.

Digital gift cards come with full tracking and transaction details including a time stamp.

There's also a number to call if the card is compromised, so there's more recourse for the consumer, said Popa.

He recommends printing out a screen grab or PDF of the digital gift card and putting it and the receipt in an envelope so there's physical evidence of the transaction.

In an emailed statement, a media relations representative for Home Depot said it works closely with its suppliers to implement fraud prevention measures.

If an issue does occur, it urges customers to reach out to the store where they bought the gift card, which Home Depot says is an "industry standard."

Home Depot says consumers should keep their receipts to help the investigation and avoid sharing the card's PIN.

The Canadian Anti-Fraud Centre also encourages people to report the fraud to them and their local police department.