A Preemptive Strike Against Holiday Fraud
PayPal is making a major security play to protect shoppers this winter. Starting this fall, the payment giant will require users to complete passkey verification whenever they purchase digital gift cards. This strict new measure aims to curb the rapid rise of “card draining” scams before the peak 2026 holiday shopping season kicks off.
Passkeys rely on facial recognition, fingerprint scans, or device PINs to verify identity. Unlike traditional passwords, they are nearly impossible for hackers to steal through phishing campaigns. By locking down gift card sales with this biometric guardrail, PayPal hopes to shut the door on scammers who use compromised accounts to buy easily liquidable digital assets.
The Growing Menace of Card Draining
Gift cards have long been a favorite target for online criminals. They are virtually identical to cash, highly portable, and extremely difficult to trace once spent. In recent years, fraud networks have perfected automated attacks to drain balances or buy digital cards using stolen login credentials. The Federal Trade Commission reported that gift card fraud cost consumers over $235 million last year alone. Digital gift cards saw the sharpest increase in unauthorized transactions.
“Scammers love digital gift cards because they can cash them out in seconds,” says Marcus Vance, a retail security researcher at cyber-intelligence firm ThreatBlock. “Once a hacker gains access to a consumer’s PayPal account, they bypass the physical shipping address barrier by purchasing digital vouchers. They drain the account and disappear before the victim even notices the email receipt.”
This specific type of theft is part of a broader trend known as card draining. It occurs in two main ways:
- Physical tampering: Scammers clone barcodes and PINs from physical store racks, waiting for unsuspecting buyers to load funds before draining them remotely.
- Digital exploitation: Automated bots use credential stuffing to breach accounts, instantly buying digital vouchers that are quickly resold on secondary markets.
Friction with a Purpose
The threat has grown so severe that PayPal decided a voluntary security opt-in was no longer enough. The company first introduced passkey support in late 2022. However, adoption remained steady but slow among casual users. By making passkeys mandatory for gift card purchases, PayPal is forcing a shift toward stronger cryptography.
Starting in October, anyone attempting to buy a gift card through the PayPal digital gifts portal or partner merchants using PayPal checkout must authenticate using a registered passkey. If a user hasn’t set up a passkey on their device, the system will prompt them to create one on the spot before the transaction can proceed.
This friction is intentional. Some users might find the extra step annoying at first. However, PayPal security teams argue that the minor inconvenience is worth the massive protection upgrade. The company’s internal data shows that accounts using passkeys experience virtually zero successful credential-stuffing attacks. Because passkeys are built on FIDO Alliance standards, they don’t share secret keys over the internet, making them immune to server leaks.
Preparing for the Winter Rush
The timing of the rollout is strategic. Fraud rates traditionally spike between November and January. Millions of shoppers rush to buy last-minute presents, and criminals take advantage of the digital chaos. By implementing the mandate in early autumn, PayPal hopes to iron out any user friction before the Black Friday rush.
Other major tech firms are watching closely. Financial security analysts believe that if PayPal’s passkey mandate successfully drops fraud rates, other digital wallets and retail giants may follow suit. Apple, Google, and Microsoft have already built deep native support for passkeys, making the infrastructure readily available to most smartphone and computer users today.
For now, the mandate specifically targets digital gift cards, which remain the highest-risk category for instant cash-outs. PayPal hasn’t announced plans to make passkeys mandatory for all everyday purchases. Still, security experts think it’s only a matter of time. As online theft becomes more sophisticated, the classic password’s days are clearly numbered.