Attackers exploit a verification gap that lets gift purchases bypass two-factor authentication and appear as legitimate transactions.