Gift card scam emails from your "boss"

It starts with something harmless: "Are you at your desk? I need a quick favor." A few messages later, your "boss" asks you to buy several gift cards for a client or staff rewards, scratch off the backs, and send photos of the codes. They're in meetings, so they can't talk. They'll pay you back. None of it is real. This guide explains how the boss gift card scam works, why email is the perfect channel for it, and the simple policy that stops it.

How does the boss gift card scam work?

The FTC describes the scene: it "often starts with an unexpected text, email, or a call from your 'boss' asking for an 'urgent favor.'" The scammer tells you "to go to the store, buy gift cards, and send them the numbers on the back." They may even ask for "Google certificates."

To look like your manager, the FTC says scammers either use "a spoofed email address" or hack into the real account. They "make up a story about needing your help with something" and promise to pay you back later (FTC, 2021). Once you hand over the card number and PIN, the money is gone.

New hires are a favorite target. The FTC's business blog reports that "scammers are following hiring updates on social media and quickly contacting new employees," and some new employees get "an urgent message from the boss, asking for a big favor: purchase gift cards and hand over the numbers" (FTC, 2025).

A typical exchange

1. The opener: "Hi, are you available? I need you to handle something for me discreetly." No link, no attachment.
2. The excuse: "I'm in back-to-back meetings and can't take calls."
3. The ask: "I need gift cards for some clients as a surprise. Can you pick them up today? I'll reimburse you."
4. The detail: a specific brand, a number of cards, and a value for each.
5. The handover: "Scratch off the back and send me clear photos of the codes."
6. The repeat: if it works, "great, can you get a few more?"

Each step is designed to stop you checking. The first email contains nothing a filter can flag, and the conversation only turns to money once you've replied.

What are the red flags?

The sender address is worth checking every time, but it isn't enough. If the boss's real account is hacked, the message arrives from the genuine address. See how to spot a phishing email for checking senders and headers.

What should you do if you get a gift card request?

1. Don't reply to the message. A reply tells the scammer you're engaged.
2. Check with your boss directly. The FTC says to use "a number or email you know is real — don't respond to the number or email you were contacted from."
3. If you can't reach them, the FTC suggests checking with a trusted colleague. Don't buy anything while you wait.
4. Report it to IT or your manager, and with your mail app's report button. Our guide on how to report a phishing email shows the steps.
5. Warn colleagues. The same scammer may have messaged them too.

What if you've already bought the cards or sent the codes?

Act fast. The FTC says to "report the gift card scam to the gift card company right away" and ask for your money back.

1. Contact the company that issued the card (the brand on the card), tell them it was used in a scam, and ask for your money back.
2. Keep the cards and the store receipt. The FTC says a quick photo on your phone works, and you'll need them for the report.
3. Tell your employer at once. If the boss's account was hacked, IT needs to secure it and check what else the attacker did. Our guide to the signs an email account is compromised covers the cleanup.
4. Report it to the FTC at ReportFraud.ftc.gov. The FTC notes, "The sooner you report, the better chance you'll get your money back."

Nobody should be blamed for reporting a loss quickly. The faster you report, the more there is to recover.

What verification policy stops gift card scams?

The FTC's business guidance boils down to one idea: tell staff in advance how you will and won't communicate, so a fake message stands out (FTC, 2025). Write it down, include it in onboarding, and make it apply to everyone, including the owner.

A gift card and payment request policy you can adopt

1. Nobody in this company will ever ask you to buy gift cards as part of your job, by email, text, chat or phone. Any such request is a scam. The FTC suggests saying exactly that: "Unlikely to ask your employees to buy gift cards as part of their official duties? Tell them that."
2. Gift card codes and PINs are never sent by email, text or photo, to anyone.
3. Every unusual money request is confirmed by phone on a number from the staff directory, not from the message.
4. Managers will never ask for secrecy about a purchase or payment.
5. Staff purchases go through normal company systems, never personal cards with promised reimbursement.
6. If you can't reach the requester, the answer is no until you can.
7. Reporting is always welcome. Nobody is criticized for checking with their boss or for reporting a message that turns out to be real.

The FTC's small business guide adds a wider rule worth copying: "If someone demands that you pay with a wire transfer, cryptocurrency, or gift cards, don't pay." The same thinking stops larger frauds such as fake invoices and business email compromise.

How do you warn staff without scaring them?

A short, specific message works better than a long security lecture. Send it to everyone, repeat it in onboarding, and resend it when a new wave appears.

Scammers are emailing and texting staff while pretending to be managers, and asking for gift cards. We will never ask you to buy gift cards, keep a purchase secret, or send card codes. If you get a request like this, don't reply. Call the person on the number in the staff directory, then report the message to IT. Thank you for checking; nobody will mind.

Name the managers most likely to be impersonated, usually the owner, the CEO and anyone whose name appears on your website. Tell assistants and new starters first; they're the people most eager to help quickly. If you have shared mailboxes such as info@ or office@, make sure whoever reads them knows the policy too.

Which email controls make the scam harder?

A policy stops the payment. Technical controls cut down how many of these messages reach staff in the first place.

• External sender tags. A visible "External" label makes a "CEO" writing from outside the company stand out.
• Impersonation protection. In Microsoft 365, user and domain impersonation protection is part of Defender for Office 365 anti-phishing policies (Microsoft Learn). It flags senders whose name and address imitate the people and domains you choose to protect. Our guide to stopping phishing in Microsoft 365 covers the settings.
• DMARC enforcement. At p=quarantine or p=reject, receivers can refuse mail that forges your exact domain, so the scammer can't send as ceo@yourcompany.com without breaking in. Check it with the DMARC Checker. DMARC doesn't stop free webmail or lookalike domains.
• MFA on every mailbox, so a stolen password alone can't turn the boss's real account into the sender.
• Inbound filtering that weighs sender reputation, authentication and impersonation before mail reaches the inbox.

Next steps

1. Send your team a two-line message today: "We will never ask you to buy gift cards. If anyone does, it's a scam; call me on my usual number."
2. Add the verification policy above to onboarding, because new hires are targeted first.
3. Check your domain's SPF, DKIM and DMARC with the free Email Health Check.
4. If you want impersonation and spoofing filtering in front of every mailbox on your domain, see how iBlockSpam works.

Browse our other phishing and threat guides.