How can I tell a real gift code email from a fake one?

Real ones give you a code and ask nothing. Fake ones require you to log in, verify or enter a code somewhere.

Is it safe to click a link in a gift code email?

Safer not to. Type the brand's address yourself and look for the same thing there. It costs thirty seconds and defeats almost all of it.

I entered my code on a suspicious site. What now?

Redeem it immediately if you still can, then check the balance and report any loss the same day. These are drained within minutes.

Phishing that targets gift codes: what it looks like

Why the usual advice fails here

"Be suspicious of unexpected emails with links and urgency" describes a real gift code email perfectly. The normal heuristics cannot tell the two apart, so you need checks specific to this case.

Check 1 — does it ask you to give, or does it give?

The single most useful distinction.

A real gift code email gives you something. The code is in the message. Nothing is asked of you.
A phishing email asks for something. Log in to claim. Verify to release. Enter your code to check the balance.

Anything requiring you to enter a code or credentials somewhere is suspect. Real codes arrive already delivered.

Check 2 — go there yourself

Never use the link. Open the brand's site by typing the address, sign in normally, and look for the thing the email mentioned.

If the email is real, it will be there. If it is not there, the email was not real. This check is slow, boring, and defeats nearly everything.

Check 3 — does it match something you did?

A code you asked for, at the address you asked from, with the order number you were given, is very likely real.

A code you did not ask for is either a present — in which case the sender will confirm when you ask them directly — or bait.

Ask the person, on a channel you already had. Not by replying.

Check 4 — what is the urgency doing?

Real deadlines exist, but they behave differently:

Real: "this expires on 30 November", a date, months away, stated once.
Fake: "within 24 hours", "before your account is suspended", repeated, with consequences.

Manufactured urgency exists to stop you doing check 2.

The specific trap: fake balance checkers

Covered in how to check a gift card balance, and worth repeating because it is the most effective one running.

You receive a code, you want to know it is real, you search for a balance checker, and you type the code and PIN into a site you have never heard of. You have just handed the balance to a stranger, and the site helpfully reports the correct balance so nothing seems wrong.

Check balances only on the brand's own site, or in store.

If you already clicked

Do not enter anything else. Close the tab.
If you entered a code, redeem it immediately if it is still yours.
If you entered account credentials, change that password now and anywhere it was reused.
Check the balance and report any loss the same day.