From working with various retailers under similar circumstances, there is a communication system whereupon the cards at purchase are activated via network with the card issuer (in this case Microsoft, Sony, AMC Theatres, TGI Fridays, whoever), and it's synced with their system and at that point it becomes valid.
Before then it's just a hash of numbers that's blocked off.
So to begin with they might block off a million, ten million codes etc. Print cards, distribute them to partner retailers. At this point, the retailers are not charged at all. It's just a value add to be a part of that network (eg; customer might come in to the store/visit site to buy something else, and decide to buy a card too, or come to buy a card, and buy something else while there, win/win).
Then if/when a card is purchased, the code for the card is entered into the network connection with the card issuer, and activated, and then that retailer is on the hook for their portion of the card price back to the issuer (95%/99%/100%) of sale value, deals vary.
Unsold cards, stolen cards, lost/destroyed cards have zero value, they are just numbers on a reserved but worthless block until sold/paid/activated.