I find their gimmick of "buy a physical gift card from Amazon, scratch to reveal one-time code" to be pretty genius. It's just a bulk pile of cards, Amazon records you bought one but doesn't know which one (and the actual code is under a scratch-to-reveal surface).

Even if a three-letter agency intercepted your package and swapped your gift card with a known code, I believe Mullvad is not recording the connection between specific gift code and the account number.

You can also exchange unscratched gift cards with friends and strangers.