2 min read
Sandra works in operations at a mid-size company. On a Tuesday afternoon, she got an email from her CEO, David. It was short. Friendly. Urgent.
"Hey Sandra. I'm in back-to-back meetings and can't take calls. I need you to grab four $200 Amazon gift cards for a client surprise. Buy them and send me the codes. I'll pay you back today. Please keep this between us for now."
The email address looked close. One letter off from David's real address. Sandra didn't notice. She was busy. The message felt real. David always moved fast. She drove to the pharmacy. Bought the cards. Scratched off the codes. Sent them. David never asked for any of it.
What Happened
A scammer impersonated Sandra's CEO using a lookalike email address. The message used urgency, authority, and secrecy to push Sandra into acting fast. By the time she realized, the gift card codes were already gone. Gift card codes are instant cash. They cannot be reversed.
This scam works because it targets trust, not technology. Scammers research companies on LinkedIn, company websites, and social media. They know your CEO's name. They know who handles things. The FBI's Internet Crime Complaint Center (IC3) reported that Business Email Compromise caused over $2.9 billion in losses in 2023 alone. No one is immune. No company is too small.
Remember the Framework
Simple Steps to Protect Yourself
-
Check the sender's email address carefully. Look at every character. Scammers change one letter and count on you being busy.
-
Never act on urgent financial requests from email alone. Pick up the phone. Call the person directly using a number you already know.
-
No legitimate executive will ask you to keep a payment secret. That phrase is a red flag. Stop and verify.
-
Gift cards are never a valid business payment method. If someone asks for gift card codes, it is a scam.
-
At home, the same rule applies. If a family member texts asking for gift card codes urgently, call them first. Scammers target personal accounts too.
Do This Today
Look up your company's reporting method for suspicious emails and save it somewhere easy to find. Forward nothing. If you get a suspicious message like this, report it to IT before doing anything else. Tell one coworker about this scam today. Awareness spreads faster than any policy.
Quick Checklist
-
Did the sender's email address match exactly?
-
Did the message create unusual urgency or ask for secrecy?
-
Did I verify through a second channel before acting?
-
Did I remember that gift cards are never a valid work payment?
-
Did I report it to IT or my manager?
Zero Trust Human Habit of the Week
Before acting on any urgent financial or unusual request from a manager or executive, verify it by calling them directly. Email can be faked. A phone call cannot.