Buy Gift Cards: The Scam Instruction That Maps the Regulatory Perimeter

On 22 July 2026 the Federal Trade Commission (FTC) reissued advice it has repeated for years. If a stranger makes contact, demands money and will accept it only by bank transfer, wire transfer, cryptocurrency, payment app, or gift card, that is a scam. The evidence behind the advice is not thin; the FTC told the Joint Economic Committee in March 2026 that consumers filed three million fraud reports in 2025, reporting losses of $15.9 billion. Yet read as compliance intelligence and not as consumer guidance, that short list of instruments is something less comfortable. It is a map of where the payment transparency regime stops, thins or fails to bite. Criminals drew it.

The profession reads the list psychologically, as a question of what a frightened person can be talked into. Criminals do not choose that way. They choose the instrument that leaves least behind, and what leaves least behind is whatever the rules do not reach.

The instruction is a deliberate choice

The clearest evidence that payout selection is engineered comes from the supervisor best placed to see it. In a notice issued on 4 August 2025, the Financial Crimes Enforcement Network (FinCEN) recorded that, according to law enforcement, scammers have directed victims to specific virtual currency kiosks, in some cases across state lines, likely to avoid operators with strong anti-money laundering controls. That is not a preference for a technology; it is routing by control quality, performed machine by machine. The same notice describes scammers extracting repeated payments from one victim and switching mechanism as they go, from the machine to wire transfers, or to cash or gold handed to a courier.

Instrument choice, in other words, is a regulatory judgement made by someone who has no obligation to publish their methodology. Three instruments recur, and each says something different about the perimeter.

Gift cards are not payments

The instrument named most often in scam scripts is the one that most payment law does not treat as a payment at all. Under the Bank Secrecy Act, an arrangement providing closed loop prepaid access of no more than $2,000 for any device on any day is not a prepaid program. That lifts the anti-money laundering programme, the suspicious activity reporting and the customer records the prepaid access rule would otherwise impose. FinCEN's own answers to industry questions, published in 2011 and supplemented in 2016, sharpen the point. The threshold attaches to the device rather than the person; purchases of separate cards by one individual in a single day need not be aggregated; and the exclusion applies whether or not the card can be spent abroad. Twenty cards, twenty thresholds, one buyer.

For cards of this kind, a retailer crosses into regulation only by selling more than $10,000 of prepaid access to one person in one day without policies reasonably adapted to prevent it. Europe has drawn a comparable line for longer. Cards sold on that basis generally sit within the limited network exclusion at Article 3(k) of the second Payment Services Directive. The exclusion survives into the incoming payments package, on the compromise texts the Council of the European Union published on 23 April 2026.

What the exclusion permits was set out in a federal indictment returned in the District of New Hampshire and announced by the Justice Department on 22 July 2026. Gift cards taken from romance fraud, elder fraud and hacking victims were used to buy high value electronics. The goods were consolidated at a warehouse in Salem, New Hampshire, then reshipped to China, with the network alleged to have coordinated purchases and settlement over a messaging application. The allegations are untested. The mechanism they describe is the one the exclusions permit: value crossed a border. No wire moved, no message travelled, and no institution stood in the middle to be asked about it.

The FATF looked and stepped back

Buying a gift card at a till is a card purchase of goods from an onboarded merchant, which places it squarely inside a long-standing exemption in the Financial Action Task Force (FATF) payment transparency standard. Under the Interpretive Note to Recommendation 16 (R16), transfers flowing from such a purchase need only carry the card number, with the names and locations of the issuing and acquiring institutions available on request. A footnote goes further and disapplies the responsibilities of ordering, intermediary and beneficiary institutions to card payments for goods and services altogether. The exemption is not an oversight; it reflects a defensible judgement that ordinary retail spending is a poor laundering channel and that rebuilding card messages would cost more than it recovered.

The FATF nonetheless came close to narrowing it. Its explanatory note for the revised R16 records that the February 2024 consultation proposed confining the exemption to purchases from merchants, and sets out the concern behind that proposal: that use of the exemption "had gone beyond its original intended scope and was enabling uncontrolled cross-border transfers". The term was dropped after industry feedback that no definition of merchant would be comprehensive and that introducing one risked disturbing acquirers' existing due diligence. Issuer and acquirer identity was moved into card network directories instead of into the message.

Read that against what the same revision did elsewhere and the asymmetry becomes hard to miss. Cash withdrawals were brought inside the definition of a payment or value transfer for the first time.

Cross-border withdrawals now attract a targeted obligation to supply the cardholder's name to the acquiring institution within three business days, on the express reasoning that coverage gaps may come to be exploited more systematically. The FATF can therefore act at the level of a single instrument, and did. It acted on an instrument that does not feature in scam payout scripts and left untouched the one that features in almost all of them. Guidance on payment transparency is expected before the end of 2026, and scope is the question worth watching.

Membership is not control

Virtual currency kiosks make the opposite case, and it is no more encouraging. Kiosk operators have been inside the perimeter throughout their growth: they are money services businesses under the Bank Secrecy Act, obliged to register with FinCEN, maintain a compliance programme and report suspicious transactions from $2,000 upwards. FinCEN's notice cites a 2021 New Jersey inquiry which found that more than a third of the companies operating kiosks in that state had not registered at all.

Yet losses have risen regardless. The Federal Bureau of Investigation's Internet Crime Complaint Center logged 10,956 complaints involving cryptocurrency kiosks in 2024, then 13,460 in 2025, with adjusted losses climbing from $246.7 million to $389 million. More than half of the 2025 complaints came from people over 50. The Bureau notes that those losses cannot be attributed to the kiosks alone, since one complaint may span several payment methods, but the direction of travel is not in question.

Correction, when it arrived, came from outside the anti-money laundering system entirely. Indiana banned virtual currency kiosks outright in March 2026 under House Enrolled Act 1116, making operation an act the attorney general can pursue as a deceptive consumer sale, and Tennessee and Minnesota followed within two months. The United Kingdom took the shorter route: the Financial Conduct Authority has approved no firm to offer crypto ATM services, so any machine running in the country is doing so illegally, and it has prosecuted an operator, seized machines and inspected sites in Exeter, Nottingham and Sheffield. On 18 May 2026 Bitcoin Depot, the largest operator in North America, filed for Chapter 11 and took some nine thousand kiosks offline, its chief executive citing state compliance obligations, new transaction limits and outright bans. Bank Secrecy Act registration did not constrain the instrument. Consumer protection statutes and a licensing refusal did.

Protection reaches one rail

The third instrument, the bank or wire transfer, is the only one of the three that sits inside both the payment transparency regime and, in the United Kingdom, a mandatory reimbursement scheme. That scheme works. An independent evaluation published by the Payment Systems Regulator (PSR) on 1 July 2026 found that in-scope scam losses over Faster Payments fell by around 21 per cent in the first year, roughly £73 million.

Now count what it covers. Reimbursement applies to payments executed over Faster Payments or CHAPS. A victim who buys gift cards has made a card purchase. A victim who feeds cash into a kiosk has bought an asset. Neither has made an in-scope scam payment. Civil disputes over goods fall outside as well, on the reasoning that the consumer was not deceived.

The regulator has mapped the exit route itself. Its consolidated policy statement puts payments taking place across other payment systems outside the requirement, and the worked example it chooses is a consumer moving funds to an account at a crypto exchange and then paying a fraudster in cryptocurrency. The scam script thus appears inside the policy statement, as a description of where the protection stops. Strengthening a rail does not remove the criminal from the system; it tells them which rail to stop using.

The funding leg holds the evidence

If the payout instrument falls outside the perimeter, the last regulated observation of a scam is not the payment at all. It is the withdrawal or the purchase that funded it, at the victim's own institution, hours earlier. FinCEN has already said as much. Among its red flags for institutions other than kiosk operators are a customer withdrawing substantial cash who mentions being told to deposit it at a machine, and a customer using a debit card for repeated payments to a kiosk operator below the currency reporting threshold. Both events happen at a bank. Neither is a payment message.

Three consequences follow for firms. Monitoring built around payment messages will not see any of this, because the observable events are a cash withdrawal and an unremarkable retail transaction. Scope under R16 must not be confused with scope under suspicious transaction reporting, since a card purchase attracts no payment transparency responsibilities and full reporting obligations at the same time. And a customer who moves between instruments inside a single relationship deserves to be treated as a typology, not as noise.

There is a governance point underneath the operational one. The perimeter around these instruments is being redrawn by consumer protection legislatures, licensing decisions and prosecutors, not by anti-money laundering supervisors. A firm tracking only the implementation deadline at the end of 2030 is reading the wrong calendar.

The instruction was always the answer

Consumers are told that the moment they hear the words gift card, the conversation is over. Compliance functions should hear something more precise in the same words: a statement about where obligations end and who absorbs the loss when they do. Criminals are not probing the quality of payment data; they are probing its scope, continuously, at retail volume, and publishing the findings in the form of an instruction. That instruction has not changed in substance for years; cryptocurrency was added to it, and nothing has been removed. The explanation is not a failure of criminal imagination. It is that the boundary has not moved, and the map is still accurate.

Do you treat a gift card purchase as a payment risk, or as a retail transaction?

We can map where your customers' money leaves the perimeter, show you what your controls would have seen, and give you something better than an assumption to put in front of a supervisor; contact us.

At OpusDatum we trace a customer's whole journey towards a loss, not the single leg that happens to carry a payment message. Our wire transfer regulation practice tests whether monitoring, reporting and record keeping stretch to the withdrawal and the purchase as well as the transfer. It starts from the question a criminal asks first: which instrument leaves the least behind?