2 min read
That "Gift Card Request" from your boss? It probably wasn't your boss.
Martha was wrapping up a busy Tuesday when a text message arrived from her CEO's number.
"Hey Martha, I'm in back-to-back meetings and can't talk. I need you to grab four $100 Google Play gift cards for a client appreciation thing. Scratch off the codes and send me photos. I'll pay you back today. Please keep this between us for now."
Martha felt a little rushed, but the request seemed plausible. Her CEO did travel a lot. She walked to the pharmacy, bought the cards and sent the photos.
An hour later, she mentioned it to a colleague. The colleague looked confused. "He's been in the office all day. I just had lunch with him."
Martha checked the original text more carefully. The phone number was close to her CEO's, but not exact. One digit was different.
The money was gone.
What Happened
A scammer impersonated Martha's CEO using a spoofed phone number. The request used three classic pressure tactics: urgency, secrecy and a familiar name. Gift cards are the payment method of choice for scammers because they are instant, untraceable and irreversible. Once the codes are shared, the money cannot be recovered.
This scam costs people real money, often hundreds of dollars at a time. It works because it targets trust, not technology. The FBI's Internet Crime Complaint Center (IC3) reported that business email and impersonation scams resulted in over $2.9 billion in losses in 2023 alone. No executive, IT department, HR team or government agency will ever ask you to pay for something with gift cards.
Remember the Framework
Simple Steps to Protect Yourself
-
Any request involving gift cards, wire transfers or urgent payments is a red flag. Stop and verify before you act.
-
Contact the person directly using a phone number you already know. Do not reply to the message or call the number it came from.
-
Check the sender's phone number or email address carefully. Scammers use numbers and addresses that look almost right.
-
"Keep this between us" is a warning sign. Legitimate urgent requests do not require secrecy.
-
Apply the same rule at home. If a family member or friend texts asking for gift cards urgently, call them directly to confirm.
Do This Today
✔ Save your CEO's, manager's, and IT team's real phone numbers in your contacts right now so you can spot an impersonator quickly.
✔ Share one sentence with a coworker today: "No real boss will ever ask you to buy gift cards."
Quick Checklist
-
Did the request come with urgency and secrecy? Pause.
-
Is payment being requested in gift cards or wire transfer? Stop.
-
Did you verify directly with the person using a known number? Always do this first.
-
Did you check the sender's number or email address carefully? Check before you act.
-
Did you report the suspicious message to IT or your manager? Do it even if you are unsure.
Zero Trust Human Habit of the Week
Before acting on any payment or gift card request, call the person directly using a number you already have saved. One phone call stops this scam every time. A few extra seconds can protect your account, your data and the people who trust you.