Holiday Gift Card Rush: AI Agents for Balance Calls

Every December, the same phone call comes in dozens of times a day: "Hi, I got a gift card for your shop. How much is left on it?" It's a two minute interruption for whoever's behind the counter, usually right when the line is longest.

For a café, salon, bookstore or restaurant in Burnaby, that call is a perfect first job for an AI phone agent. It's repetitive, it has a single correct answer, and the answer lives in a system you already own. But it also touches money and personal data, so it's worth setting up carefully. Here's what the rules say, what the tooling can actually do as of October 2026, and where we'd tell you not to bother.

Why balance calls spike after the holidays

Cards bought in December get redeemed in January and beyond, so the questions keep coming long after the rush you staffed for.

In BC, there's a legal reason this question matters. Under section 56.4 of the Business Practices and Consumer Protection Act, when a gift card is sold the supplier must give the buyer "a description of the way in which a consumer can obtain information respecting the prepaid purchase card, including any remaining balance." So you already owe your customers a way to check their balance. The only question is whether that way is a busy staff member, a website, or an automated line.

What BC law says about the cards themselves

Before you automate answers, make sure the answers are right. An AI agent that confidently tells someone their card "expired last year" could be telling them something that isn't legal in BC.

According to Consumer Protection BC, "gift cards, vouchers or credits for a specific dollar amount, for example, a $50 gift card to a spa, are not allowed to expire." The exceptions it lists include cards for a specific good or service (a gift certificate for a manicure can expire), cards sold at a discount, cards sold for charitable purposes, and cards bought before 2009.

Fees are restricted too. The Prepaid Purchase Cards Regulation, B.C. Reg. 292/2008, section 3, allows a fee "for replacing a lost or stolen prepaid purchase card" or "to customize a prepaid purchase card." Mall cards that work at multiple stores have their own rules, including a purchase fee of up to $1.50 and, after a period of non use, a monthly charge of up to $2.50.

The practical takeaway: write these rules into the agent's instructions, and have it say "let me get someone to help" rather than improvise on anything about expiry or fees.

How an AI balance line actually works

A balance agent has three parts, none of them exotic.

The voice layer. Something has to turn the caller's speech into text and the reply back into speech. For example, Twilio's ConversationRelay documentation, which we checked in October 2026, describes a service that handles speech recognition and text to speech and streams the conversation to your application over a WebSocket. Twilio's docs make clear you bring your own AI model; the service doesn't include one.

The model. The AI listens for intent ("check my balance"), asks for the card number, and phrases the answer. Its job is conversation, not bookkeeping. It should never be the source of the balance figure.

The lookup. The real number comes from your point of sale. If you run Square, for example, its Gift Cards API reference (checked October 2026) documents a "Retrieve gift card from GAN" endpoint, `POST /v2/gift-cards/from-gan`, which needs the `GIFTCARDS_READ` permission and returns the card's balance and state. Square's gift card guide also lists Canadian limits, including a maximum balance of $2,000 CAD per card. Other POS systems differ, and some don't expose a balance lookup at all, so check yours first.

The key design choice is that the AI calls one narrow, read only function and reads back exactly what it returns. If the lookup fails, the agent says so and offers a callback. It doesn't guess.

The security part people skip

A phone line that tells anyone the balance of any card number is a gift to fraudsters. If a card number can be guessed, an open balance line lets someone test numbers until one hits. Square's own guide warns developers to "avoid using repeatable patterns or GANs that are easy to guess (such as 12345678)."

The OWASP Top 10 for LLM Applications calls this class of problem "Excessive Agency" (LLM06:2025): an AI system doing damaging things because it was given more functionality, permissions or autonomy than it needed. OWASP's mitigations map neatly onto a balance line:

• Minimize functionality. Give the agent a balance lookup and nothing else. No reloads, no transfers, no refunds.
• Minimize permissions. Use a read only API credential, scoped to gift cards.
• Enforce limits outside the AI. Put rate limits and lockouts in your own code, per caller and per card, so a clever prompt can't talk its way past them.
• Require a human for high impact actions. Lost card replacement, disputes and anything involving a refund go to a person.
• Log and monitor. OWASP notes that monitoring and rate limiting don't prevent misuse but do limit the damage.

Consider asking for the security code or PIN on the back of the card as well as the number, if your POS supports it. And never let the agent read a full card number back out loud.

Privacy: collect less than you think

Most balance checks don't need a name, email or phone number. Canada's privacy regulator agrees with that instinct. The Office of the Privacy Commissioner's Principles for responsible, trustworthy and privacy-protective generative AI technologies (December 2023) tells organizations to "limit the collection, use, and disclosure of personal information to only what is needed" and to "inform individuals what, how, when, and why personal information is collected."

For a small Burnaby retailer, that translates into a short greeting that says the caller is talking to an automated assistant, a clear note if calls are recorded, and a retention setting that deletes transcripts after a sensible period. If you're a private BC business, BC's Personal Information Protection Act will generally apply, so it's worth a quick conversation with whoever handles your privacy policy.

A rough way to size it

Here's an illustrative example, not a client result. Say a shop gets 15 balance calls a day in January, each taking about two minutes once you count the hold and the lookup. That's half an hour of staff time a day, often during service. If an agent answers 10 of those fully and passes the rest to staff, you've given back roughly 20 minutes a day for a few weeks. Real numbers vary a lot, so count your own calls for a week before deciding anything.

Where this doesn't apply

Automation isn't always the right call here. Some honest limits:

• Your POS has no balance API. If the only way to check a card is to tap it on the terminal, an AI agent can't help, and a printed receipt with a balance or a web lookup from your POS provider might be all you need.
• You get a handful of calls. If it's three a week, the setup and monitoring cost more than the time you'd save.
• Paper certificates. If your gift certificates are handwritten or tracked in a spreadsheet, fix that first. AI won't make messy records accurate.
• Your POS already does it. Many providers offer an online balance page. Putting that link on the card and your voicemail greeting may cover most of the demand for free.
• Callers who need judgment. Disputes, lost cards and "my card says zero but I never used it" calls need a person. The agent's job is to route those quickly, not to handle them.

Speech recognition also struggles with long digit strings on noisy lines, so test with real card numbers and real background noise, and plan for a fallback to text or a staff callback.

The short version

A gift card balance line is one of the safest places for a small business in Metro Vancouver to try an AI phone agent: narrow job, clear answer, data you already own. Do it with a read only lookup, hard limits outside the AI, BC's expiry and fee rules written into its instructions, and a quick handoff to a human for anything else.

Sources

• Province of British Columbia, Business Practices and Consumer Protection Act, SBC 2004, c. 2, Part 4, s. 56.4 "Information to be provided", BC Laws. https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/04002_05
• Province of British Columbia, Prepaid Purchase Cards Regulation, B.C. Reg. 292/2008, BC Laws. https://free.bcpublications.ca/civix/document/id/complete/statreg/292_2008
• Consumer Protection BC, "Gift cards" (consumer information page), accessed October 2026. https://www.consumerprotectionbc.ca/consumer-help/consumer-information-gift-cards/
• Square Developer, "Retrieve gift card from GAN", Gift Cards API reference, accessed October 2026. https://developer.squareup.com/reference/square/gift-cards-api/retrieve-gift-card-from-gan
• Square Developer, "Using the Gift Cards API", accessed October 2026. https://developer.squareup.com/docs/gift-cards/using-gift-cards-api
• Twilio, "ConversationRelay" documentation, accessed October 2026. https://www.twilio.com/docs/voice/conversationrelay
• OWASP Gen AI Security Project, "LLM06:2025 Excessive Agency", OWASP Top 10 for LLM Applications, 2025. https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
• Office of the Privacy Commissioner of Canada, Principles for responsible, trustworthy and privacy-protective generative AI technologies, 2023. https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/

Want a balance line running before the January rush? Book a free call with Autana Solutions. We'll look at your POS, count what your phones are actually doing, and tell you honestly whether an AI agent is worth it for your shop.