Can someone use my Gift Card (M&S) if they have a photo of the barcode? What to do if so...

GabbaGabbaHey

A QR code is just a more complex version of a bar code (it can encode far more information, and has markers to help with orientation for machine reading). Anything encoded in a QR code can - like a bar code - be converted to plain text very easily.

jon81uk

Seagull27 said:

I don't think the pin number is accessible from the bar code, but can't say for sure. 

I personally don't feel like it's good practice to allow purchases to be made with just the bar code. Those cards can hold up to £1000! I think it would be a much better idea if the cards had to be used physically (so with a cashier), or - if they feel the self service is a must - by somehow making it that you have to use the cards pin at the machine. Otherwise it's just too easy to access the large amounts of money...

Every gift card I've ever used has only required the barcode or magnetic stripe when you are using the card in store. The PIN is only needed when typing it in online. Treat gift cards as cash, if you lose the physical card, you have lost the money. The PIN is on the card anyway so if someone is in possession of the card, they will know the PIN.

But this is all irrelevant now at the OP has confirmed the card has been fully spent as someone used the barcode.

Tunstallstoven

jon81uk said:

Every gift card I've ever used has only required the barcode or magnetic stripe when you are using the card in store. 

How many tend to be barcode and how many magnetic strip?  I've never really had gift cards so I wouldn't know.  Obviously with a magnetic strip the physical card would be needed rather than just a screengrab from a computer; which in my opinion makes it the better choice.

jon81uk said:
Treat gift cards as cash, if you lose the physical card, you have lost the money. 

Fair enough, and at least they do make this point clear.  They don't however make it clear that a photo of the card would be sufficient to access the funds.  In fact, I was told the physical card would be needed in store.  Plus, so far none of the M&S staff I've spoken to have been aware that a photo/screenshot of the barcode would be enough to spend the card in store.  So it's not common knowledge it would seem.  Furthermore, I could take a photo of cash and post it online.  No-one would be able to access the cash if I did so.  

jon81uk said:
The PIN is on the card anyway so if someone is in possession of the card, they will know the PIN.

Sure.  But they weren't in possession of the card.

jon81uk said:

But this is all irrelevant now at the OP has confirmed the card has been fully spent as someone used the barcode.

That much is true.  Except perhaps someone searching M&S Gift Card in the future might come across this and just might be tipped off to not make the same mistake I did.

jon81uk

Seagull27 said:

jon81uk said:

Every gift card I've ever used has only required the barcode or magnetic stripe when you are using the card in store. 

How many tend to be barcode and how many magnetic strip?  I've never really had gift cards so I wouldn't know.  Obviously with a magnetic strip the physical card would be needed rather than just a screengrab from a computer; which in my opinion makes it the better choice.

jon81uk said:
Treat gift cards as cash, if you lose the physical card, you have lost the money. 

Fair enough, and at least they do make this point clear.  They don't however make it clear that a photo of the card would be sufficient to access the funds.  In fact, I was told the physical card would be needed in store.  Plus, so far none of the M&S staff I've spoken to have been aware that a photo/screenshot of the barcode would be enough to spend the card in store.  So it's not common knowledge it would seem.  Furthermore, I could take a photo of cash and post it online.  No-one would be able to access the cash if I did so.  

jon81uk said:
The PIN is on the card anyway so if someone is in possession of the card, they will know the PIN.

Sure.  But they weren't in possession of the card.

jon81uk said:

But this is all irrelevant now at the OP has confirmed the card has been fully spent as someone used the barcode.

That much is true.  Except perhaps someone searching M&S Gift Card in the future might come across this and just might be tipped off to not make the same mistake I did.

From memory most places use mag stripe, M&S is in the minority using barcodes but I think John Lewis/Waitrose might be barcodes too.

To be honest I don't think many people go round putting photos of gift cards online and if someone was to raise this issue with a retailer they probably would just advise against selling it on eBay anyway.

Tunstallstoven

In my case I spoke to the retailer before listing it for sale.  They did not advise against me doing so.  They DID advise that the physical card would be needed to make a purchase in store.  They did not advise me that someone having a screenshot of the barcode would be able to access the funds (most likely because they didn't know; subsequent advisers I've spoken to after the even were not aware it would be possible).

JillyBaby66

I feel awful for you, I think many of us would have done the same without realising and you DID due diligence by checking with the retailer beforehand. It is theft when all said and done..
One might argue your were partly responsible for not keeping it dafe but no more than if you, say, put it down in the counter while packing your bags and it was nicked  from under your nose ?
I would try M&S again. Explain you wrongly advised and could they check where/when it was spent ? You are, after all, still in procession of the card and maybe able to prove it couldn't be you.
They may just offer a replacement as a "goodwill" gesture, they are a retailer that prides itself on it's customer service.
If you or a friend or family member is on Twitter ( I assume M&S are ? ) it can often be good to use that: doing so in a public forum often elicits a better response and you can warn others against doing the same while you're at it.
I hope you get some recompense 🙏

Tunstallstoven

Thanks @JillyBaby66 - that's a very kind and thoughtful first MSE post

The first chap I spoke to at M&S sounded very hopeful about a goodwill payment to cover the loss, but the departments I've spoken to since regarding authorising this have closed the door quite firmly.  They are happy to help with police enquiries (they'd have to wouldn't they?), but nothing beyind that other than, well, "bad luck".  Twitter or a similar place to bring it up is a good idea, although I've never done anything on such before so I'll have to find my way around it first!  

Many thanks for the post

JillyBaby66

I did hesitate as I'm sure there's people more knowledgeable than I on here but I really felt for you and wanted to do something to help.
I am on Twitter ( though not especially tech-savvy myself 😂 ) M&S are on there @marksandspencer. I just had a glance and second post was from someone having issues with an "e-voucher" (?) that got a response in a few hours so may be worth a try ?
It's not that hard to set up an account, just email, password username etc  ( same as on here really ) or ask someone post for you if already on there. 
Hopefully a few others might comment and draw attention to your plight ! 🙏

jonesMUFCforever

I won a £100 M&S gift card - just printed a copy off and took it to the till - that was all that was needed to use it.

JillyBaby66

Congratulations - I would have been chuffed with that 😄 but that astonishing  ! Surely it leaves the system wide open to abuse.  Anyone with printer could scan it in and copy without the owner's permission ?  I guess if you were good with that stuff and had a half decent graphics app  you could mock one up from scratch ?
I think they need to take a serious look at their procedures !
PS this reminded me of a little while back when they upgraded their Loyalty Card which I'd previously had stored on my phone but no longer worked as it's ancient 😂 They sent out several discount offers and a £5 voucher. I showed the email on my phone and even a screenshot of the barcode ( off my tablet which I don't take shopping as a rule 😉 ) They refused it as they needed the "actual card". 🤔