It's the second week of December. Your office manager gets an email that looks like it came from you: "Are you at your desk? I need a favor. Keep this between us for now."
A few messages later, the favor is clear. Buy 5 gift cards at $200 each for client appreciation, scratch off the backs, and email photos of the codes. You're in a meeting and can't talk.
It isn't you. By the time anyone checks, the $1,000 is gone, and gift card money doesn't come back.
What it costs
This is a form of business email compromise: a criminal pretends to be someone your staff trusts and asks for money. The FBI's 2025 Internet Crime Report puts business email compromise losses at about $3 billion in a single year.
Gift card requests are the small-ticket version, and that's why they work. $1,000 doesn't trigger an approval process. An employee can put it on a company card or their own card, and many do, expecting to be reimbursed.
The bigger version follows the same script: a fake vendor email with new bank details, timed for when you're paying year-end invoices.
Why it fools careful people
The scam doesn't rely on bad judgment. It relies on 3 things every good employee has: they want to help the boss, they respect a request for discretion, and they're busy.
The holidays add cover. Gift cards for clients and staff are normal in December. Owners really are out of the office more. A rushed request from "you" doesn't look strange.
The email often comes from a free account with your name on it, or from an address one letter off from your real domain. On a phone, where most people read email, the display name is usually all anyone sees.
3 rules that stop it
Verify by phone, every time
Any request for gift cards, a wire or new bank details gets a call to a number you already have. Never the number in the email. It takes 30 seconds.
Nobody buys gift cards by email
Make it a written policy: IDN, your bank and you will never ask staff to buy gift cards by email or text. Say it out loud at your next team meeting.
Discretion is a red flag
Teach your team that "keep this between us" and "I'm in a meeting, can't talk" are warning signs, not reasons to rush.
How to spot the fake
| Warning sign | What to check |
|---|---|
| Urgent and secret | A real owner can wait 2 minutes for a phone call. |
| Sender address | Tap the name to see the full address. Look for a free email account or a domain that's one letter off. |
| Reply-to address | Hit reply and look at where it's going before you send anything. |
| Payment method | Gift cards, wire transfers and changed bank details are the scammer's favorites. |
| Mobile only | "Sent from my iPhone" and short messages hide most of the clues. Check on a computer. |
How IDN closes the gap
Policy is the first line. Your email setup is the second. IDN flags messages from outside your company that use an employee's name, blocks look-alike domains, and turns on multi-factor authentication so a stolen password can't be used to send fake requests from a real account.
We also run short phishing training and test emails, so your team has seen this scam before the real one arrives.
We're in Racine. If someone on your team clicks something they shouldn't, you get a response in 10 minutes.
- CLIENTS SERVED
- 1,000+
- RESPONSE SLA
- 10-MIN
- IN SE WISCONSIN
- SINCE 2004
Gift card scam questions
- What is a gift card scam at work?
- A criminal sends an email or text pretending to be the owner or a manager and asks an employee to buy gift cards, then send photos of the codes. The codes are spent within minutes, and the money can't be recovered.
- Can I get the money back from a gift card scam?
- Rarely. Contact the gift card company right away and report it to the FBI at ic3.gov, but once the codes are used, the money is usually gone. Prevention is the only reliable protection.
- How do scammers know who our owner is?
- From your website, LinkedIn and social media. Names, titles and email formats are easy to find, so they can make a convincing email in a few minutes.
- What should an employee do if they already sent the codes?
- Tell the owner and IT right away, call the gift card company's fraud line, and report it at ic3.gov. Then check whether the email came from a real company account, which would mean a password was stolen.
Find out how exposed your inbox is
IDN's free IT assessment checks your email protection, multi-factor authentication and look-alike domain risk. You get a plain-language list of what to fix before the next fake request lands.