Woolworths customers report hundreds of dollars stolen from digital gift cards

Dozens of Woolworths customers say they've lost hundreds of dollars after discovering their digital gift cards were drained by transactions they did not authorise.The ABC has been contacted by customers across Australia who say their Everyday WISH gift cards, purchased through the Everyday Rewards website or app, were spent by someone else.Some customers have reported losing up to $500, with transactions appearing at stores in different states from where the cards were purchased.Woolworths has acknowledged an issue affecting "a number of" customer e-gift cards, apologising to those affected and saying it is investigating the reports as a priority."We recognise the concern this has caused affected customers and we apologise to customers impacted," a spokesperson said.Complaints first appeared on Australian bargain-sharing website OzBargain last week, with similar reports subsequently emerging across Facebook and Reddit.All of the customers who contacted the ABC appear to have purchased their gift cards during a promotional offer through Everyday Gifting that advertised a 4 per cent discount.Everyday WISH gift cards can be redeemed in store and online at participating Woolworths Group retailers and partners, including Big W, BWS, Dan Murphy's and Cellarmasters.The complaints reported to the ABC so far involve Everyday WISH cards purchased digitally through the Everyday Rewards website or app. (Supplied)Deborah Kellie, from Brisbane, said she lost $500 after purchasing an Everyday WISH card last Monday."I have been an Everyday Rewards customer for ages, and I usually buy my rewards cards through the RACQ," she said.But Ms Kellie said a promotional email from Everyday Gifting advertised a "great deal", offering an extra 1 per cent discount on WISH gift cards compared with RACQ."So I thought I've got to go shopping next week, I'll get one from them [Everyday Gifting] instead."Two days later, she discovered the entire balance had been spent at a Big W store in Doncaster, Victoria, despite never having used the card or shared its details.In Sydney, Michael Bennett said he had also switched from buying the WISH gift card through the NRMA app after seeing the 4 per cent discount offer in the Everyday Rewards app.He said he purchased a $400 WISH gift card through the app on November 9. But when he attempted to use it at a Woolworths store in Hornsby on November 14, the card had disappeared from his digital wallet.Deborah Kellie says her gift card was drained in another state two days after she purchased it. (Supplied)After checking the balance through a link in his email, he discovered the money had been spent.The transaction history showed $400 had been spent at a Big W store in Pagewood, in Sydney's east, on November 12.Mr Bennett said he had not shared the gift card details, his mobile phone had remained in his possession, and his Everyday Rewards account was protected by a complex password and two-factor authentication.He also said the gift card had never been physically printed."Woolworths warn customers to treat gift cards like cash," Mr Bennett said."It turns out they [gift cards] are much less secure than cash as key information can be stolen remotely."Suspecting a cybersecurity breach, Ms Kellie said she cancelled her Visa card as a precaution.She said she made three attempts to contact Woolworths customer service, but was unable to speak to anyone despite waiting for more than an hour on the phone the first two times.On her third attempt, Ms Kellie said an automated message advised the company was receiving an increasing number of calls before disconnecting her.She subsequently emailed Woolworths screenshots and details of the transactions and lodged a report with cybersecurity authorities.The report has since been referred to Queensland Police for assessment in correspondence seen by the ABC.Following ABC enquiries, a Woolworths spokesperson advised customers who notice an unrecognised transaction to contact its Gift Card Support team at giftcard@customerservice.woolworths.com.au.Customers can also log into the Everyday Gifting website and register their details on the homepage."Our team will work directly with customers to determine the appropriate next steps, including issuing replacement e-gift cards for customers impacted," the spokesperson said.How does gift card fraud happen?The complaints reported to the ABC so far involve Everyday WISH gift cards purchased digitally through the Everyday Rewards website or app.Woolworths has not said how the affected gift cards were accessed or whether a security vulnerability or data breach is suspected.The digital purchases make traditional in-store gift card tampering less likely. In that form of fraud, criminals steal card details from products displayed in stores before they are purchased and activated.An ABC investigation earlier this year uncovered tampered Apple gift cards being sold by Australia's biggest supermarkets, including Woolworths, with criminal charges subsequently laid over the issue.Other forms of gift card fraud involve criminals impersonating individuals or organisations and tricking victims into purchasing cards and handing over the codes.But customers who have contacted the ABC say they did not share their card details or knowingly authorise the transactions.It remains unclear how the gift card details were obtained or how the unauthorised transactions could occur.