The Gift Card Request From "Your Boss"
"Are you available? I need a quick favour." How the boss gift card scam targets employees, why it works, and the simple rule that stops it.
It starts with a short message from your boss: "Are you at your desk? I need a quick favour." When you reply, the request arrives. They are stuck in meetings and need gift cards for a client, a staff reward or an urgent purchase. Could you buy them, scratch off the codes and send photos? They will reimburse you later. It is a scam, and it catches people in organizations of every size.
How the scam works
- Impersonation: an email from a lookalike address, a text or WhatsApp from a "new number", or a hacked account, using a senior person's name.
- The opener: "Are you available?" This checks you are engaged before the ask.
- The request: gift cards, often several of a high value, for a plausible business reason.
- The pressure: the boss is busy, cannot take calls, needs it quickly and discreetly.
- The codes: you are asked to send photos of the card numbers and PINs.
- A free email address, not the company domain.
- Gift cards for a business purpose, paid by you personally.
- No calls, urgency and secrecy.
Why it works
- Authority: people want to help senior colleagues quickly.
- Plausibility: businesses do sometimes buy gifts for clients and staff.
- Busy moments: the message often arrives when the real boss is travelling or in meetings, information sometimes found online.
The rule: no one at work should ever ask you to buy gift cards or send codes by message. Confirm any unusual request through a channel you already use with that person.
What to do if you get one
- Do not buy anything or reply with codes.
- Contact your manager through a known channel: call their usual number or message them on your work chat.
- Report the message to your IT or security team.
- If you already sent codes, contact the gift card issuer immediately with the card numbers and receipts, and tell your employer.
For organizations
- Publish a simple rule: managers never request gift cards or payments by message.
- Add warnings for external emails and emails using executives' names from outside the company.
- Train staff with this exact example, and praise people who report.
- For larger payment requests, see business email compromise; our business email compromise guide explains the controls.
Got an odd request from "your boss"? Paste it into CyberWatch AI Scan for a free check.
The same trick is used with community leaders; see church and community leader impersonation. For all common types of online scams, read our complete guide.
Frequently asked questions
Why would a scammer want gift cards from employees?
Gift card codes can be spent or resold within minutes, are hard to trace, and do not require a bank account. An employee's wish to help their boss does the rest.
The email came from my manager's name. Is it real?
Display names are easy to fake. Check the actual email address, and confirm by calling or messaging your manager through your normal work channels.
What should organizations do?
Set a clear rule that managers never ask staff to buy gift cards or make payments by message, make reporting easy, and train staff with examples of this exact scam.
Sources
- Stop Gift Card Scams, US Federal Trade Commission
- Avoiding and Reporting Gift Card Scams, US Federal Trade Commission
- Phishing: spot and report scam emails, texts, websites and calls, UK National Cyber Security Centre
