Scam library · Small business · Texts · Email & phishing
Boss gift card request scam
'Are you available? I need a quick favor. I'm in a meeting and can't talk.' Then: please buy six $200 gift cards for client appreciation and send photos of the codes. I'll reimburse you today.
The message uses your boss's name, sometimes their photo. It's from a scammer who found your organization's staff list online.
What the message looks like
From: +1 (415) 555-0158, 'Pastor Dan'
Hi, are you free? I'm in a meeting and can't take calls. I need you to get some gift cards for a few people we're supporting. I'll pay you back this evening.
Get 5 Apple gift cards at $200 each, scratch the back and send me pictures of the codes.
How this scam works
These messages target employees, volunteers at churches and nonprofits, and staff of small businesses. Scammers pick new employees or people listed on websites and LinkedIn.
Gift cards are popular with scammers because the codes can be used quickly and are hard to trace. The FTC says anyone who demands payment by gift card is a scammer.
The same approach is used for urgent wire requests to finance staff and for payroll changes asking HR to update a direct deposit account.
Scammers often start with a harmless question, like 'Are you at your desk?', so you're already engaged before the ask arrives. If you reply, they move fast and keep you busy so you don't stop to check.
Leaders can help by telling staff and volunteers plainly: 'I will never ask you to buy gift cards or move money by text.' Saying it once removes the pressure people feel to help quickly. Organizations can also add a simple rule that any purchase request must be confirmed by phone or in person.
Red flags
- A message from a leader using a new number or personal email.
- 'I'm in a meeting and can't talk.'
- Gift cards, with photos of the codes requested.
- Urgency and secrecy.
- A promise of reimbursement later.
How to tell it’s fake
- Call your boss or leader on the number you already have.
- Check your organization's policy on purchases and reimbursements.
- Never send gift card codes based on a text or email.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you haven't bought anything, stop and report the message to your manager or IT team.
If you paid
- If you bought cards, call the gift card company right away with the codes and receipts. Report it at ReportFraud.ftc.gov.
If you shared personal info, a password or a code
- If the scammer asked about payroll or HR details, alert HR and finance.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome and Edge on your computer recognizes boss-impersonation messages in email and chats you have open in the browser, like WhatsApp Web or Gmail. It flags the gift card ask, the 'can't talk' excuse and the new number. If a request seems legit, a quick check with the real person or a scam expert prevents a costly mistake.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Why would a scammer want gift cards?
- Gift card codes are fast to use and hard to trace or reverse.
- How did they know my boss's name?
- From your organization's website, social media or LinkedIn.
- Can I get my money back for gift cards?
- Sometimes, if you contact the gift card company very quickly.