Executive Impersonation and Gift Card Requests at Work
"Are you free? I need you to buy some gift cards for clients, I'll reimburse you." How executive impersonation works at work and the simple rule that stops it.
It starts with a short email or message from "the director": "Are you at your desk? I need a quick favour." Then the request: buy gift cards for clients or staff rewards, scratch off the codes and send photos. The director never sent it.
I'm in meetings all afternoon. I need 5 gift cards of 100 each for client appreciation. Please buy them now and send me photos of the codes. I'll sort reimbursement later. Keep this between us for now.
The rule
No gift cards, payments or bank changes because of a message alone. Call the person on a number in the company directory.
Making the rule work
- Leaders should say publicly that they will never ask for gift cards by message.
- Staff should feel safe checking, even with senior people.
- Report attempts so others can be warned. See reporting at work.
Related: the boss gift card scam, payment requests from the boss on WhatsApp and whaling. For more, see our guide to business cybersecurity.
Frequently asked questions
Why gift cards?
They can be converted to cash quickly and are very hard to trace or reverse.
The email came from the manager's name. Isn't that enough?
Display names are easy to fake, and real accounts can be hacked. Always confirm by calling on a known number.
What should staff do if they already bought cards?
Contact the card issuer immediately with receipts and card numbers, and tell your manager and security contact.
Sources
- Avoiding and Reporting Gift Card Scams, US Federal Trade Commission
- Cybersecurity for Small Business, US Federal Trade Commission
- Phishing attacks: defending your organisation, UK National Cyber Security Centre
