Gift Cards Testing Checklist (2026)

Gift Cards Testing Checklist (2026) provides a comprehensive, actionable list of test scenarios that cover the full lifecycle of a gift‑card feature—from issuance and redemption to expiration, refunds

June 20, 2026 · 19 min read · Testing Checklists

Gift Cards Testing Checklist (2026) provides a comprehensive, actionable list of test scenarios that cover the full lifecycle of a gift‑card feature—from issuance and redemption to expiration, refunds, and security hardening. Use this guide as a reference you can bookmark, adapt to your stack, and run manually or through autonomous exploration tools.

Gift Cards Testing Checklist (2026): Overview and Objectives

The purpose of this checklist is to give QA engineers and developers a concrete, verifiable set of items that can be ticked off during test planning, execution, and release sign‑off. Each item includes a clear pass criterion, a real‑world example, and guidance on whether it is best suited for manual execution, scripted automation, or autonomous exploration.

Why a dedicated checklist matters

Gift‑card flows touch payments, accounting, user‑experience, and compliance. A missing validation can lead to revenue loss, regulatory fines, or brand damage. By structuring tests around the areas below, you ensure that both functional correctness and non‑functional qualities receive the same rigor.

How to use this document

  1. Copy the tables into your test‑management tool (e.g., TestRail, Zephyr) as test cases.
  2. Map each ID to a test‑case ID in your repository.
  3. Mark the execution mode (M = manual, A = automated, X = autonomous) that fits your capacity.
  4. Review the pass/fail criteria before running; adjust thresholds to match your business rules (e.g., maximum card value, allowed currencies).
  5. Re‑run the checklist after each major release or after any change to the gift‑card service API.

Gift Cards Testing Checklist (2026): Happy Path Scenarios

Happy‑path tests verify that the core gift‑card workflow succeeds under normal conditions. These are the baseline scenarios that must always pass.

Issuance and activation

IDDescriptionPass CriteriaM/A/X
HP‑01Purchase a gift card of $25 via credit card.Order completes, card code generated, email/SMS delivered with correct code and value.M/A
HP‑02Bulk purchase of 10 gift cards (different values) in a single checkout.All 10 codes appear in order confirmation, each with correct denomination, no duplicate codes.A
HP‑03Redeem a gift card for a product priced exactly at the card balance.Checkout shows $0 due, order placed, card balance updates to 0, redemption logged.M/A
HP‑04Redeem a gift card partially (e.g., $10 of a $50 card) and continue shopping.Remaining balance displayed correctly, subsequent purchase uses updated balance, transaction atomic.A
HP‑05Send a gift card as a gift to another user’s email.Recipient receives notification, can view card details, sender’s balance unaffected.M/A
HP‑06Apply a gift card together with a promotional coupon.Both discounts applied, order total reflects sum, gift‑card balance reduced appropriately.A
HP‑07Refund an order that used a gift card (full or partial).Gift‑card balance restored to original amount, refund transaction recorded, no double‑credit.M/A
HP‑08Check gift‑card balance via API or web portal before and after redemption.Returned balance matches ledger after each operation, latency < 200 ms.A/X

Expiration and renewal

IDDescriptionPass CriteriaM/A/X
HP‑09Redeem a gift card on its last valid day (expiry date = today).Transaction succeeds, system marks card as expired after redemption.A
HP‑10Attempt to redeem an expired gift card.Payment gateway rejects with clear error code “EXPIRED_CARD”, balance unchanged.M/A
HP‑11Extend expiry date via admin panel for a specific card.New expiry date reflected in balance queries, no impact on other cards.A
HP‑12Auto‑expire a batch of cards at midnight UTC.All cards with expiry < current date show status “EXPIRED” in admin UI, no further redemptions allowed.X

Multi‑currency and localization

IDDescriptionPass CriteriaM/A/X
HP‑13Purchase a gift card denominated in EUR while store default is USD.Exchange rate applied correctly, receipt shows both amounts, card balance in EUR.A
HP‑14Redeem a EUR‑denominated card in a store that accepts only USD.System converts at checkout using prevailing rate, displays converted amount, user approves.A
HP‑15Display gift‑card UI in French (fr‑FR) locale.All labels, placeholders, error messages translated, date format DD/MM/YYYY.M/A

Gift Cards Testing Checklist (2026): Error Handling and Validation

Error‑handling tests ensure the system degrades gracefully and provides useful feedback when something goes wrong.

Input validation

IDDescriptionPass CriteriaM/A/X
EH‑01Enter non‑numeric characters in the gift‑card amount field (e.g., “abc”).Inline validation blocks submission, shows “Please enter a valid number”.M/A
EH‑02Submit a gift‑card code with incorrect length (too short/long).Error “Invalid card code format” appears, focus remains on field.M/A
EH‑03Attempt to redeem a card with a code that does not exist in the database.Response “Card not found”, HTTP 404, no side‑effects.A
EH‑04Try to purchase a gift card with a negative amount.Transaction rejected, error “Amount must be greater than zero”.M/A
EH‑05Enter a value exceeding the maximum allowed per card (e.g., $10,000 when limit is $5,000).Validation prevents submission, shows “Maximum value per card is $5,000”.M/A
EH‑06Submit duplicate gift‑card code during manual code entry (copy‑paste error).System detects duplicate, prompts “This code has already been used”.A
EH‑07Use special characters (<, >, &, “, ’) in the recipient name field for a gift‑card gift.Input sanitized, stored as escaped string, no XSS payload rendered.A/X
EH‑08Attempt to apply a gift card after the checkout session has timed out.System returns “Session expired, please start checkout again”, card balance unchanged.M/A

Business‑rule violations

IDDescriptionPass CriteriaM/A/X
EH‑09Redeem a gift card for a product that is prohibited for gift‑card use (e.g., alcohol in jurisdiction where not allowed).Checkout blocks with message “Gift card cannot be used for this item”, order proceeds without card.A
EH‑10Apply more than one gift card to a single line item when policy allows only one per order.Second card rejected, error “Only one gift card per order permitted”.A
EH‑11Attempt to refund a gift‑card‑only purchase to the original payment method instead of the card.Refund routed back to gift‑card balance, audit log shows correct flow.A
EH‑12Try to redeem a card that is currently pending activation (status = PENDING).System returns “Card not yet activated”, no balance change.A
EH‑13Perform a concurrent redemption of the same card from two devices at the same millisecond.System serializes requests, second request receives “Insufficient balance” or “Card already redeemed”, final balance correct.X
EH‑14Redeem a card after a chargeback on the original purchase that funded the card.System marks card as VOID, any redemption attempt fails with “Card voided due to chargeback”.A

Gift Cards Testing Checklist (2026): Edge and Boundary Cases

Edge cases expose issues that rarely appear in everyday use but can cause significant impact in production.

Value limits and precision

IDDescriptionPass CriteriaM/A/X
EB‑01Purchase a gift card with the minimum allowed value (e.g., $0.01).Transaction succeeds, balance shows $0.01, no rounding errors.A
EB‑02Purchase a gift card with the maximum allowed value (e.g., $10,000).Transaction succeeds, balance shows exactly $10,000.A
EB‑03Add a fractional cent amount (e.g., $10.005) – system should round to nearest cent.Amount rounded to $10.01 (or truncated per policy), receipt shows rounded value, ledger matches.A
EB‑04Redeem a card for a purchase that results in a sub‑cent remainder after tax (e.g., $9.99 tax $0.005).System applies tax rounding rule (e.g., round half‑up), final charge uses correct cents, balance updated accordingly.A
EB‑05Attempt to purchase a gift card with a value that would cause integer overflow in a 32‑bit balance field.System rejects with “Value exceeds supported limit”, no crash.A
EB‑06Redeem a card repeatedly until balance reaches $0.0001 (if sub‑cent accounting is allowed).System either prevents further redemption or correctly handles sub‑cent remainder per policy.A

Time‑zone and calendar edge cases

IDDescriptionPass CriteriaM/A/X
A/X
-----------------------07to redeem a gift card at 238:5 (UTC) on the last second of the
EB‑08Purchase a gift card at 23:59:59 local time on Dec 31, card expiry set to “end of day”.Expiry timestamp stored as 2024‑12‑31 23:59:59 UTC (or per policy), card valid for that entire day.A
EB‑09Redeem a card exactly at midnight UTC when the server clocks are skewed by +2 System uses NTP‑adjusted time, expiry checkEB‑10A gift cardzone that does not observe DST,.user’s local time zone does not observe DST.EB‑11Attempt to use a gift cardon Feb 29 during a leap year.Expiry handling treats Feb 29 as valid; card expires on Mar 1 if set to “end of month”.A
EB‑12Perform a high‑frequency burst of balance checks (100 req/s) on a single card.All responses return correct balance, no rate‑limit false positives, latency < 150 ms.X
EB‑13Redeem a card while the order total is exactly zero (free item with 100 % discount).Gift‑card balance unchanged, order completed, no erroneous deduction.A
EB‑14Attempt to redeem a card after the user’s session has been invalidated server‑side (e.g., forced logout).System requires re‑authentication, rejects redemption with “Unauthorized”, balance unchanged.A

Gift Cards Testing Checklist (2026): Accessibility (WCAG) Checks

Accessibility verifies that users with disabilities can perceive, operate, and understand the gift‑card flow.

Visual and contrast

IDDescriptionPass CriteriaM/A/X
AC‑01Verify contrast ratio between gift‑card code text and background on the redemption page.Ratio ≥ 4.5:1 for normal text, ≥ 3:1 for large text (WCAG AA).A
AC‑02Ensure that error messages are announced by screen readers when inline validation fails.ARIA‑live region announces “Invalid card code” immediately.A
AC‑03Check that the gift‑card amount input field has a visible label and associated element.Label text read by NVDA/VoiceOver, clickable label focuses the input.M/A
AC‑04Verify that the “Apply gift card” button is keyboard‑focusable and has a discernible name.Tab order reaches button, aria-label or inner text conveys purpose.A
AC‑05Test that the gift‑card balance tooltip meets WCAG 2.1 AA for non‑text contrast (if using icons).Contrast ≥ 3:1 against adjacent background.A
AC‑06Ensure that any CAPTCHA or bot‑challenge presented during bulk purchase has an audio alternative.Audio challenge available, operable via keyboard.A

Navigation and interaction

IDDescriptionPass CriteriaM/A/X
AC‑07Verify that a user can complete the gift‑card purchase flow using only the keyboard (no mouse).All interactive elements reachable via Tab, Enter/Space activates buttons, Arrow keys modify dropdowns.A
AC‑08Test that the gift‑card code entry field respects the inputmode="numeric" attribute on mobile devices.Numeric keypad appears, no alphabetical keys shown.A
AC‑09Ensure that dynamic updates (e.g., balance after redemption) are announced via ARIA live region.Screen reader reads “New balance: $25.00” without requiring page reload.A
AC‑10Check that the gift‑card terms and conditions link is accessible and opens in a new tab with proper target="_blank" and rel="noopener" attributes.Link focusable, new tab announced, no loss of context.M/A
AC‑11Validate that the gift‑card UI does not rely solely on color to convey status (e.g., red for invalid, green for valid).Additional icon or text label present.A
AC‑12Perform a zoom test (200 %) on the gift‑card page; ensure no loss of content or functionality.All text readable, buttons usable, no horizontal scrolling required.M/A

Gift Cards Testing Checklist (2026): Security and Privacy Considerations

Security tests protect against fraud, data leakage, and unauthorized manipulation of gift‑card assets.

Data protection

IDDescriptionPass CriteriaM/A/X
SE‑01Verify that gift‑card codes are never logged in plain text in application or server logs.Log search for a known test code returns no matches; logs show only hashed or tokenized reference.A
SE‑02Ensure that the gift‑card database column storing codes is encrypted at rest (AES‑256 or equivalent).Attempt to dump DB file shows ciphertext, decryption key not exposed.A
SE‑03Confirm that API responses returning gift‑card details mask the full code after first redemption (e.g., show only last 4 digits).Response shows ** ** 1234, full code only available to authorized internal services.A
SE‑04Test that TLS 1.2+ is enforced for all gift‑card related endpoints (purchase, redeem, balance).Network trace shows TLS 1.2, no fallback to TLS 1.0/1.1.A
SE‑05Validate that rate limiting is applied to redemption attempts per IP/account (e.g., 5 attempts/minute).After 5 rapid failed attempts, further requests receive HTTP 429 with retry‑after header.A
SE‑06Check that password‑reset or account‑recovery flows do not expose gift‑card balances or codes.Recovery email contains no gift‑card data, only account‑reset link.A
SE‑07Perform an OWASP ZAP passive scan on the gift‑card endpoints; ensure no high‑severity findings (e.g., SQLi, XSS).Scan report shows zero high‑risk alerts.A
SE‑08Verify that web‑hook notifications for gift‑card events (purchase, redeem) include a signed payload (HMAC‑SHA256) that receivers can validate.Receiver rejects tampered payload, accepts valid signature.A

Fraud and abuse prevention

IDDescriptionPass CriteriaM/A/X
SE‑09Attempt to brute‑force gift‑card codes using a dictionary of common patterns (e.g., 6‑digit numeric).Account/IP locked after configurable threshold, audit log shows “Brute‑force attempt blocked”.A
SE‑10Try to reuse a gift‑card code after a successful redemption (replay attack).Second redemption rejected with “Code already used”.A
SE‑11Simulate a man‑in‑the‑middle attack by stripping TLS and injecting a false balance response.Client detects certificate mismatch, aborts connection, no balance update.A
SE‑12Test that admin actions (e.g., extending expiry, adding balance) require MFA and are logged with user ID and timestamp.Audit entry shows MFA verification, action cannot be performed without second factor.A
SE‑13Verify that gift‑card numbers are not sequential or predictable (e.g., using a cryptographically secure RNG).Statistical test on 10,000 generated codes shows uniform distribution, no obvious patterns.A
SE‑14Ensure that refunds to gift‑card balances cannot exceed the original purchase amount funded by that card.Attempt to over‑refund returns error “Refund exceeds original funded amount”.A
SE‑15Conduct a privilege‑escalation test: try to access another user’s gift‑card balance via IDOR (changing user‑id parameter).Request returns 403 Forbidden, no data leaked.A
SE‑16Validate that gift‑card codes are not exposed in URL query strings or browser history after redemption.URL contains only endpoint path, no code fragment; History API does not store sensitive data.A

Gift Cards Testing Checklist (2026): Performance and Load Testing

Performance tests confirm that the gift‑card subsystem remains responsive under expected and peak loads.

Load scenarios

IDDescriptionPass CriteriaM/A/X
PF‑01Simulate 500 concurrent users purchasing gift cards (random values $5‑$500) over 5 minutes.95 % of requests finish < 2 s, error rate < 0.5 %, no HTTP 5xx.X
PF‑02Run a sustained load of 1,000 concurrent balance‑check requests for 10 minutes.Average latency ≤ 150 ms, 99th‑percentile ≤ 300 ms, CPU < 70 %.X
PF‑03Execute a spike test: 0 → 5,000 concurrent redemptions in 30 seconds, then back to 0.System scales (autoscaling group adds instances), no request drops > 2 %, recovery within 30 seconds.X
PF‑04Perform a soak test: 200 concurrent users performing mixed purchase/redeem/check‑balance flow for 4 hours.Memory leak < 5 MB growth, GC pauses < 100 ms, no gradual latency increase.X
PF‑05Validate that gift‑card API respects configured rate limits under load (e.g., 100 req/sec per API key).Exceeding limit yields HTTP 429, legitimate traffic within limit unaffected.X
PF‑06Test database connection pool exhaustion under high concurrent redemption (2,000 req/sec).Pool size sufficient, wait time < 50 ms, no “Connection timeout” errors.X
PF‑07Verify that CDN caching of static gift‑card assets (images, scripts) yields a hit ratio ≥ 90 % under load.Cache‑hit header present, origin server load reduced accordingly.X
PF‑09Measure the time to generate and email a gift‑card code after purchase (end‑to‑end).95 % of emails delivered within 5 seconds, no queue backlog.X
PF‑10Conduct a failure‑injection test: latency‑inject 500 ms delay on the payment gateway simulator.Gift‑card purchase flow shows appropriate “Processing…” indicator, does not timeout, user sees clear error if gateway fails.X

Gift Cards Testing Checklist (2026): Release Readiness and Regression

Before a release, run a final verification that covers the checklist items that are most likely to regress.

Smoke‑test subset

IDDescriptionPass CriteriaM/A/X
RR‑01Purchase a $10 gift card, redeem it for a $10 item, verify balance zero.End‑to‑end flow succeeds, order confirmation email received.M/A
RR‑02Attempt to redeem an invalid code; verify error message and unchanged balance.Error displayed, balance same as before attempt.M/A
RR‑03Check that the gift‑card balance API returns correct value after a refund.Refund restores original amount, API reflects new balance.A
RR‑04Verify that the gift‑card UI displays the correct expiry date format per locale.Date shown as MM/DD/YYYY for en‑US, DD/MM/YYYY for fr‑FR.M/A
RR‑05Ensure that the “Apply gift card” button is disabled when the cart total is zero.Button greyed out, aria‑disabled=true.M/A
RR‑06Confirm that a promotional coupon and a gift card can be applied together without exceeding cart total.Final amount ≥ 0, discount sum ≤ cart total.A
RR‑07Validate that the gift‑card code is not visible in browser devtools Network tab after redemption.Request/response payloads do not contain the full code.A
RR‑08Run the automated regression suite (Appium + Playwright) against the staging build; all gift‑card related tests must pass.0 % failure rate for gift‑card test tags.A
RR‑09Perform a security smoke check: attempt SQL injection on the gift‑card code parameter; expect 400/403.No data leakage, proper error response.A
RR‑10Verify that the gift‑card service health endpoint returns {"status":"OK"} and latency < 50 ms.Endpoint.point.A

Integrating Autonomous Exploration with SUSA for Gift Card Testing

SUSAsection. | Endpoint reachable, correct JSON payload. | A |

Regression test tagging strategy

Integrating Autonomous Exploration with SUSA for Gift Card Testing

Autonomous exploration can exercise a large portion of the checklist without writing explicit test scripts. By pointing SUSA at your gift‑card flow, the agent discovers UI states, attempts varied interactions, and surfaces defects that might be missed in manual test plans.

How SUSA covers the checklist

Checklist AreaWhat SUSA DoesTypical Findings
Happy PathExplores purchase, redemption, balance check, refund paths using varied user personas (curious, power‑user, elderly).Missed UI states, incorrect navigation after redemption.
Error HandlingInjects malformed inputs (special characters, oversized values) via its “adversarial” persona.Validation gaps, misleading error messages.
Edge/BoundaryUses rapid‑fire and timed‑out scenarios to test concurrency and timing limits.Race conditions, timeout mis‑handling.
AccessibilityRuns with WCAG‑aware persona; checks ARIA labels, contrast, keyboard traps.Missing labels, low‑contrast text, focus order issues.
Security/PrivacyAttempts common injection payloads, enumerates endpoints, checks for data leakage in responses.Exposed gift‑card codes in logs, missing rate limiting.
PerformanceSimulates bursts of requests from multiple virtual users; measures response times.Latency spikes under load, ineffective caching.
Release ReadinessExecutes a short smoke script derived from discovered flows; validates PASS/FAIL on core paths.Regression after UI tweak, broken deep‑link.

Setting up SUSA for a gift‑card flow

  1. Install the agent
  2. 
       pip install susatest-agent
    
  3. Create a configuration file (susacfg.yaml) that defines the entry point and any required authentication:
  4. 
       target: https://shop.example.com
       auth:
         type: oauth2
         client_id: ${SUSA_CLIENT_ID}
         client_secret: ${SUSA_CLIENT_SECRET}
       scopes:
         - giftcard:purchase
         - giftcard:redeem
       personas: [curious, impatient, novice, adversarial, elderly, accessibility, power_user]
       max_depth: 6
    
  5. Run the exploration
  6. 
       susatest run --config susacfg.yaml --output reports/giftcard_run_$(date +%F).json
    

The agent will crawl the site, attempt to purchase a gift card using a test payment method (provided via a mock gateway or sandbox), redeem it, check balances, and trigger error conditions.

  1. Analyze the report

The JSON output contains a list of discovered screens, actions taken, and any assertions that failed (e.g., missing accessibility label, unexpected error code). You can map each finding back to the checklist IDs above for triage.

Example: Detecting a missing ARIA label

During a run with the accessibility persona, SUSA might log:


[WARN] Screen "Redeem Gift Card": Input field with id="giftcard-code" lacks associated <label> or aria-label.

You would then map this to checklist item AC‑03 and add a proper element or aria-label.

Combining SUSA with scripted regression

After an exploration run, you can ask SUSA to generate regression scripts:


susatest export --format appium-android --out test/giftcard_appium.js
susatest export --format playwright --out test/giftcard_playwright.js

These scripts encapsulate the exact interaction sequences the agent exercised, giving you a starting point for automated regression suites that you can refine and commit to version control.

Final Quick Reference Checklist (Gift Cards Testing Checklist (2026))

Print or copy this condensed list for daily use. Each line maps to a full checklist item; tick the box when the condition is satisfied.

Test Your App Autonomously

Upload your APK or URL. SUSA explores like 10 real users — finds bugs, accessibility violations, and security issues. No scripts.

Try SUSA Free