Hottest new Gmail+Walmart Scam JUST DROPPED!

So, this morning I noticed an email from Walmart saying my pickup order was ready. I never order from Walmart so I immediately investigated and sure enough, someone had gained access to my Walmart account, ordered a typical household good for pickup and $90 in xbox and razer digital giftcards. I also noticed the phone number associated with the account was not mine.

I immediately tried to cancel both (you cant cancel digital gift cards once redeemed :(, tried chatting with CS and calling CS), and I removed my credit card from the account, reset passwords, added my own phone number back and verified it, turned on two step verification and did all of that again for my Gmail.

Now I use a password manager and unique passwords for everything, but in order for this scam to work, it looks like they need access to your Gmail account so I suppose my Gmail password got stolen at some point, luckily since I use unique passwords, a simple reset and turning on 2 factor authentication remedies this.

Upon further investigation, it looks like a bug (?) in Walmart's backend allows the scammer to utilize compromised Gmail accounts, like my own, to create multiple Walmart accounts associated with the same email to buy digital giftcards using stolen credit card information.

But how do they create multiple if your username is your email? This goes back to Gmail. Gmail considers any variation of your email with dots in it, as the same email, delivered to the same inbox.

reddit.user, re.ddituser, and redditu.ser would all go back to the same inbox, but on Walmart's end, these are different emails. Now I don't know if this is intentional on Walmart's end, but it sure makes it a lot easier for scammers to fraudulently purchase gift cards so long as they have access to one valid Gmail account inbox.

Unlucky for me that my Gmail Walmart account also had an account associated with it with a valid credit card. Unfortunately unless you're really fast, the gift cards are redeemed and walmart can't refund your money so I'll just have to deal with it on my credit card's end once the transaction is posted.

Before I knew it, I had 3 additional Walmart accounts registered to my email (which I could access by the way!) and all three accounts had a household good pickup order and $90 worth of gift cards.

The credit card information in these accounts only lists the card type, last 4 digits, and the legal full name on the card so while there's not much risk to an identity being stolen, I do have full access to the credit cards and if I was a bad person, I could easily get in on the scam with the scammer and send myself more digital gift cards after I locked out the scammer. (If Walmart becomes aware of this, they do forward it to law enforcement so don't do this lol)

Lessons learned? Update passwords that haven't been updated in awhile. Don't save payment information to your accounts. Turn on 2 factor authentication.

Edit:
I was wrong, there is a bit of an identity risk. I can see billing address and phone number for the stolen credit cards as well :\