A gift card PIN is the secret that carries the value: whoever enters it on the issuer’s platform gets the balance. A serial number is an identifier for the card or voucher as a unit: it lets the issuer, distributor and seller trace, activate, block or investigate that unit, but on most products it cannot be redeemed on its own. Treat the PIN like cash and the serial like an invoice line.
The confusion is understandable, because the vocabulary varies by brand and not every product carries both. This article sorts out the terms, shows how they map onto real products, and sets out how a seller should store, display and log each one.
The two jobs a code can do
Every digital voucher has to answer two questions: “is this person allowed to claim the value?” and “which unit are we talking about?”. Some products answer both with one string; others split them.
The secret (PIN, code, claim code, voucher code). This is the bearer element. The issuer checks it at redemption, and if it is valid and unused, the value moves to the account that entered it. Anyone who sees it can spend it. Brands name it differently: PlayStation calls it a voucher code, and per PlayStation’s support pages it contains 12 digits and can only be used once; Many prepaid wallet brands simply say PIN.
The identifier (serial number, card number, control number). This names the unit without unlocking it. It is what appears on an invoice, in a distributor’s order record, and in a support ticket. On physical cards it is often printed in the open, while the secret sits under a scratch panel or peel-off label. On electronic deliveries it is a separate field returned next to the PIN.
The pair (card number plus PIN). Some products need both to redeem: the customer enters a card or serial number and then a PIN. The US Federal Trade Commission’s consumer guidance warns, about retail gift cards, that “the card number and PIN on the back of the card” let a fraudster take the value even while the victim still holds the card. On these products neither half is safe to expose, but the PIN is still the half that must never be shown before sale.
How the terms map in practice
| Element | Common names | Redeems value? | Safe to show before sale? | Main use for a seller |
|---|---|---|---|---|
| Secret | PIN, code, claim code, voucher code, e-PIN | Yes | No | Delivered to the end customer only |
| Identifier | Serial number, control number, card ID | Usually no | Yes, internally | Reconciliation, disputes, block requests |
| Card number | Card number, account number | Only with a PIN | No, if paired with a PIN | Redemption on number-plus-PIN products |
| Order reference | Order ID, transaction ID | No | Yes | Linking a sale to a supplier invoice |
| Expiry | Valid until, expiry date | No | Yes | Listing copy and stock rotation |
The safest default when a supplier’s documentation is unclear: treat every field that the end customer types at redemption as a secret, and every field they never type as an identifier.
Why the serial matters more than sellers think
Sellers tend to focus on the PIN because that is what the customer receives. The serial number is the field that saves you when something goes wrong.
Disputes. When a customer says a code was already used, the issuer and the distributor will investigate by unit, and the serial or order reference is how they find it. Without it, your claim becomes “a code we sold sometime last week”, which nobody can act on. The full investigation routine is in our guide to already-redeemed code disputes.
Blocking. If a batch is exposed, say through a leaked export, the issuer or distributor may be able to deactivate unredeemed units. They will ask for identifiers, not PINs. A seller who logged serials can hand over a precise list; a seller who only kept PINs has to transmit the very secrets that leaked again.
Reconciliation. Matching your order log against a supplier statement is far simpler on identifiers, which can sit in reports and spreadsheets without creating a theft risk. The routine is covered in reconciliation for digital goods.
Activation. Physical cards sold in shops are often activated at the till, and the activation is recorded against the card’s identifier. PlayStation’s support pages note that some vouchers state “no value until activated at register” and direct customers to the retailer if activation failed. Digital e-PINs delivered through an API or file are normally already live when you receive them, which is one reason they are simpler to sell online.
What a code delivery actually contains
When you draw a voucher from a distributor by API or bulk file, the record usually holds more than one value. A typical delivery includes:
- the secret the customer will redeem (PIN or code);
- an identifier for the unit (serial or similar), where the brand uses one;
- the product, face value, currency and region of the item;
- an expiry or validity date, where the brand sets one;
- your order reference and the provider’s transaction reference.
Field names differ by provider (the digital goods glossary covers the wider vocabulary), so map them explicitly during integration and confirm with the provider which fields are secret. Do not infer it from the field name: a value labelled “card number” can be a redemption credential on one brand and a harmless reference on another.
Handling rules for each element
Once you know which field is which, the handling rules follow.
Secrets. Store them encrypted or not at all, decrypt only at the moment of delivery, and keep them out of logs, analytics events, error reports and support tooling. Staff should see a masked form by default. The architecture choices are compared in storing gift card codes securely.
Identifiers. Log them freely in your order records, put them on internal invoices and support tickets, and keep them for as long as you keep the order. They are the evidence trail.
Delivery to the customer. Send the secret, the redemption instructions and the region. Include the serial too if the brand’s redemption flow asks for it, and label the two clearly so the customer does not type the wrong one into the wrong box. A serial typed where the PIN belongs is an avoidable cause of “invalid code” tickets.
Screenshots and photos. Customers sometimes post a photo of a card in a support chat. If it shows the secret, treat that code as exposed. Apple’s support pages on gift card scams make the same point from the consumer side: never give the numbers on the back of a card to someone you don’t know well or haven’t met.
Checklist for a new product or supplier
- Which field does the end customer type at redemption?
- Is there a separate identifier, and is it returned in the API or file?
- Does the brand require both a number and a PIN to redeem?
- Is the code live on delivery, or does it need activation?
- What identifier does the supplier need to investigate or block a unit?
- Are secrets masked in your admin panel and absent from logs?
- Does the delivery email label each field and state the region?
Giftoro delivers codes to businesses through an API and bulk files; the integration side is covered on our gift card API page.
Frequently asked questions
What is the difference between a gift card PIN and a serial number?
The PIN is the secret that redeems the value: whoever enters it on the issuer’s platform receives the balance. The serial number identifies the card or voucher as a unit, so issuers, distributors and sellers can trace, activate, investigate or block it. On most products the serial cannot be redeemed on its own, which is why it can appear on invoices and support tickets while the PIN must stay hidden until the customer receives it.
Can someone use a gift card with only the serial number?
On most products, no, because redemption checks the PIN or code, not the serial. Some cards, however, redeem with a card number plus a PIN, and on those the card number is half of the credential. The US Federal Trade Commission warns that the card number and PIN together are enough to take a card’s value. Confirm with your supplier which fields a given brand uses at redemption.
Where is the PIN on a gift card?
On physical cards the PIN or code is usually on the back under a scratch-off panel or peel-off label, while the serial or card number is printed in the open. On digital deliveries the PIN arrives as a separate field in the email, API response or bulk file. The exact name varies by brand: voucher code, claim code, PIN or simply code.
Is an e-PIN the same as a gift card code?
Broadly, yes. An e-PIN is a PIN delivered electronically rather than printed on a physical card, and it plays the same role as the code under a scratch panel: it is the secret that redeems the value. Some brands use the term officially; others say voucher code or digital code. We go into the term in more detail in our explainer on what an e-PIN is.
Why does my supplier send both a PIN and a serial number?
Because they do different jobs. You deliver the PIN to the customer, and you keep the serial as the reference for that unit in your own records. If a customer later reports a problem, or a batch needs blocking, the supplier and issuer will ask for the serial or order reference, not the PIN. Keeping the two in separate fields, with the PIN encrypted, makes both jobs easier.