Is an email from my CEO asking me to urgently buy gift cards and send the codes a scam?
Yes. CEO gift card impersonation is one of the most common and consistently effective business email scams.
Last reviewed: 1 August 2026
Explanation
CEO fraud or executive impersonation via email is a well-documented and frequently successful attack. An employee — often in finance, HR, or a support role — receives an email that appears to come from the CEO, managing director, or another senior executive. The message is typically short, informal, and urgent, asking the employee to purchase gift cards immediately as a gift for clients, a bonus for staff, or a confidential business purpose, and to send the codes by reply. The email address is either spoofed to display the executive's name or is a lookalike domain. Gift card codes are untraceable and irreversible. Establish a verbal confirmation policy for all gift card or payment requests — never act on such requests from email alone.
This fraud targets the workplace's social physics rather than its technology: a junior employee receiving a terse message from the top experiences a cost to questioning it that the scammer is counting on. That is why the durable fix is cultural as much as procedural. A stated policy that gift card and payment requests are always verified by voice — and, critically, visible reassurance from leadership that checking will never be punished — removes the awkwardness the scam depends on. Teams where verifying first is praised rather than merely tolerated simply stop losing money to this script.
Common red flags
- Email from an executive asks you to buy gift cards urgently without explanation
- Sender email address does not exactly match your company's real domain
- Message emphasises secrecy or speed — do not discuss with colleagues
- Request came on a Friday afternoon, a holiday, or outside normal working hours
What to do now
- Do not buy gift cards without verbal confirmation directly with the executive
- Call the executive on their known number — do not use any number provided in the email
- Report the email to your IT security team immediately
- If cards were already purchased, contact the gift card issuer and your bank
Frequently asked questions
Why do scammers ask for gift cards specifically?
Gift card codes are instantly usable, untraceable, and irreversible. They are the cash equivalent for phone and email fraud because no bank can reverse the transaction once codes are shared.
I already sent the gift card codes — is there any way back?
Act immediately: contact the gift card issuer with the card numbers and receipts and ask them to freeze remaining balances, tell your finance and IT teams, and report to your fraud authority. Speed occasionally saves part of the value, and the incident needs to be on record either way.