A Gift Card Request From the Boss? One Rule to Give Your Team Before the Holidays
Scammers pose as an owner or manager and ask staff to buy gift cards and send the codes. Here is how the request works, the one rule that stops most of it, and what to do if codes were already sent.
It usually starts with a short, friendly message: "Are you free? I'm stuck in a meeting and need a quick favor." It looks like it comes from the owner or a manager. A few messages later, the "favor" is to buy gift cards for clients or staff, scratch off the backs and send photos of the codes.
It is a scam, and the holidays make it easier to believe. Client gifts and staff thank-yous are normal this time of year, so a request for gift cards does not feel strange. The money is gone as soon as the codes are sent.
How the fake "boss" request works
The Better Business Bureau describes the pattern: scammers find out where someone works and who their boss is, then text from an unknown number posing as that boss. After a quick reply, they ask for a task, such as buying gift cards for a client or wiring money to another business, and often ask to keep it secret.
Singapore Police warned in January 2026 about the email version of the same trick. Scammers changed their display name (the name you see, not the actual address) to look like a CEO or supervisor and asked staff to buy gift cards with their own money, promising they would be paid back.
The common signs:
- An urgent "quick favor" while the boss is supposedly busy
- A new phone number, or an email whose real address doesn't match the name
- A request to keep it quiet, often called a "surprise"
- Gift cards, codes or "vouchers", and photos of the card backs
One rule that stops most of it
Tell your team, in writing, before it happens:
"We never ask anyone to buy gift cards or send card codes by text, email or chat. If a message asks, even with my name on it, call me on the number you already have."
That short note gives every employee permission to say no and to check. The BBB's advice is the same: if a request doesn't sound right, contact your boss using their real contact details, not by replying to the message.
Three habits make the rule stick:
- Share it with new hires first. People in their first weeks don't yet know how the boss normally asks for things.
- Send company gifts through one normal purchasing route. A request that skips it stands out.
- Make checking safe. Nobody should be in trouble for calling to confirm.
If someone already sent the codes
Act quickly. Contact the gift card company using the number on the card or its official website, keep the cards and receipts, and report it at ReportFraud.ftc.gov in the US. Then warn the rest of the team, since the same scammer may message them next. If the message came from a real company email account, treat it as a possible break-in and have that account's password and sign-in settings checked.
Where your own domain fits
Many of these messages come from a new phone number or a free email account, and no setting on your domain can stop those. Your team's rule is the main defense.
Your domain does matter in two cases:
- Fake mail that uses your exact address. Email records called SPF, DKIM and DMARC let receiving mail servers check whether mail really came from you. With DMARC set to reject, those servers are told to refuse forged mail sent as your domain. CertPing's free DMARC checker shows whether someone could send email as your domain today. It needs no account and changes nothing.
- Look-alike addresses. A web address with one letter changed can make a fake sender look real. CertPing checks new domain registrations daily for look-alikes of yours and alerts you with the reason and a risk level. It flags them; it does not take them down. You can try the free look-alike checker.
The most useful thing you can do this week costs nothing: send your team the one-line gift card rule.
Sources: Better Business Bureau scam alert; Singapore Police Force advisory, January 28, 2026; CertPing email security, checked November 13, 2026.