Count up in order

The mistake

The system uses sequential, incrementing integers as gift card numbers, and treats knowledge of the number alone as sufficient authorization to redeem the card's balance — there's no separate secret (PIN, hash, or random token) tied to it. Because the numbers are predictable, anyone can take a valid card number and add one to guess another live, unredeemed card, then spend its balance. The replacement cards issued afterward are generated the same sequential way, so the fix reintroduces the identical vulnerability.