How does the scammer know when the card is activated? Do they just leave a script running, trying over and over to redeem the card until it works?

Yes, I think they just keep retrying the cards on a regular basis.

Surely the company could trivially detect that?

	▲	jama211 2 days ago \| parent [-]
		They try, but a combination of multiple layers of work arounds used by the attackers, and a strong desire not to false positive legitimate voucher buyers means there’s always a way.