I don't know about GameStop, but this isn't true of Best Buy at all. All you have to do is give them your phone number and they pull up your account. There's a screen they can tap on to apply any certificates that the account has (the default is for certs to be auto issued at $5). I've redeemed certs/points plenty of times at Best Buy and I've watched them operate the screen and apply them directly with no info from me other than my phone #.
They can redeem certs but you have to redeem your points on your end. I worked at Best Buy and I've had times where I forget to redeem the points for the certificate before going in and have unfortunately looked like an idiot waiting the sometimes 5-10 Mins it takes for their system to recognize that I redeemed the points for the certificate but again 100% they cannot redeem the points.
"
How do I issue a reward certificate?
Most people will have a certificate automatically issued and emailed to them. If you've set your certificate preference level above 250 points or if you're banking your points, visit the rewards overview page to issue one manually.
How does point banking work?
Elite and Elite Plus members may choose to save points until ready to issue reward certificates. Banked points do not expire until converted to reward certificates. Check your certificate preferences now."
You may have your points set to redeem automatically and not to bank... but go into Best Buy tomorrow and sincerely ask them to redeem your points and not a cert they will let you know that needs to be done on your end.
They can see your points but these companies do this so it cannot be exploited otherwise they could see your points after you leave the store and use the points themselves using just your number and while most people are honest if this was in place you'd hear all the time of elderly people and oblivious people being ripped off for their points but it cannot be done...
It's the bare min simplest measure put in place specifically do what happen to OP cannot happen... points have to be redeemed by user... it cannot be done on their systems.