Who do I contact first, the shop or the brand?

The brand that issued the card. They are the only party who can freeze the balance. Tell the seller afterwards.

Will I get the money back?

Good odds if the code has not been spent yet, poor if it was spent days ago. If you read the code out to someone, most issuers treat it as authorised.

Is it worth reporting if I will not get the money back?

Yes. Reports are how patterns are spotted and operations get shut down, even when individual recovery fails.

What to do if a gift code was stolen or spent

First, confirm it is actually gone

Before raising anything, rule out the ordinary explanations:

Already redeemed by you, possibly on another account. Check your balances.
An authorisation holding funds for an order not yet shipped.
A typo meaning you are checking a different card.

If the balance is genuinely spent and it was not you, continue.

Within the first hour

1. Contact the card issuer — the brand, not the seller.

They are the only party who can freeze a balance. Say exactly this:

This gift card was redeemed without my authorisation. Please freeze the balance and tell me what was purchased and when.

2. Gather everything now, while it is to hand:

The code and PIN.
Where and when it was bought, and the receipt or order number.
The balance you expected.
Where the code has been stored or sent.

3. If it came from a seller, tell them too. They may have records of issuance that the brand does not.

Within the first day

Report it formally. Most countries have a national fraud reporting service. This matters even when recovery is unlikely — patterns across reports are how these operations get shut down.

If you were tricked into handing over codes, report to the shop where the cards were bought as well. Some retailers have processes for exactly this and can occasionally stop cards mid-drain.

If account credentials were involved, change that password and anywhere it was reused. A stolen code is often a symptom of a compromised inbox rather than the whole problem.

What recovery actually looks like

Being honest about the odds:

Code stolen but not yet spent: good chance of a freeze and reissue.
Spent within hours, reported immediately: sometimes recoverable, especially on digital goods that can be reversed.
Spent days ago: rarely recoverable.
You read the code to a scammer: treated as an authorised transaction by most issuers. Report anyway.

Afterwards

Work out how it leaked, because it will happen again otherwise:

Was the code in a shared space — a group chat, a synced photo album?
Was it entered on a third-party balance-checking site?
Was the inbox itself compromised?

Then change the habit. How to keep gift codes safe and organised covers the storage side.

If it was a code we sent you

Reply to your confirmation email with the order number. We keep a record of what was issued and when, which is the evidence the brand will ask for.