Fake Boss Gift Card Request Scam
An employee receives an urgent message appearing to come from their manager or company executive asking them to purchase gift cards on the company's behalf and share the codes. The request is fraudulent.
Last reviewed: 11 June 2026
What this scam is
The fake boss gift card scam, also called the CEO gift card scam or executive impersonation gift card fraud, exploits workplace authority dynamics. Fraudsters create a spoofed email address or use a similar-looking domain, or simply send a text message claiming to be from a senior leader.
Gift cards are the payment method of choice because they are available everywhere, can be purchased anonymously, and their codes can be redeemed immediately once shared. Unlike bank transfers, there is no cooling-off period and virtually no chance of recovery once the codes are used.
The scam targets employees across organisations of all sizes. Those in finance, administration, and executive-assistant roles are especially common targets because they are accustomed to acting on behalf of leadership.
How it works
The scammer identifies a target employee using LinkedIn or a company website and finds the name of a senior person in the organisation. They then send a short, authoritative message from a spoofed or near-identical email address — for example, swapping a letter or adding a domain like '.co' instead of '.com.'
The initial message is deliberately brief: 'Are you available to help me with something urgent?' Once the employee responds, the follow-up explains the gift card request. The scammer keeps the employee engaged by reiterating urgency, claiming they are in a meeting and cannot call, and asking for updates as the purchase progresses.
The employee buys the cards with their own funds — often several hundred to several thousand dollars worth — scratches off the PIN, and sends photos of the codes. The scammer redeems the codes within minutes, making recovery impossible.
Why this scam works
Employees are conditioned to respond quickly to requests from management, especially when framed as something the executive cannot handle themselves. The implicit message is that agreeing to help is a sign of trustworthiness and initiative.
The claim that the sender is unavailable to speak — in a meeting, on a call, travelling — prevents the most obvious verification step: picking up the phone. The combination of authority, urgency, and unavailability is highly effective at bypassing normal caution.
A typical pattern
An employee receives a text or email that appears to be from their direct manager or a senior executive. The message says the sender is in a meeting and cannot talk, but needs the employee to urgently buy several gift cards — usually for a business purpose such as client rewards or a staff event. The employee is asked to buy the cards at a local retailer, scratch off the PIN panels, and text or email the codes back immediately. The 'executive' promises to reimburse them. Once the codes are sent, the scammer redeems them and the employee is left out of pocket, having paid with their own money.
Common red flags
- Request for gift cards for any business purpose received only via message
- Sender claims to be unavailable to speak on the phone
- Urgency framing: must be done today, right now, before a deadline
- Request to photograph or type out the PIN codes and send them back
- Sender's email domain is slightly different from the company's official domain
- No prior pattern of this type of request from this person
- Request to keep the task between the two of you
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
'Are you free right now? I need your help with something urgent — I am in a meeting and cannot call.'
'I need you to buy [amount] worth of [brand] gift cards from a nearby store. It is for a client surprise. I will reimburse you today — just send me the codes as soon as you have them.'
'Please do not mention this to anyone yet — I want it to be a surprise for the team. Just grab the cards and send me the numbers on the back.'
Common variations
- Accounts-payable variant: target is in finance and asked to process a 'vendor payment' via gift cards
- HR variant: fake HR head asks employees to distribute gift cards as a staff bonus
- Charity variant: fake executive claims they are donating to a charity on behalf of the company and need codes sent urgently
- Multi-store variant: employee is asked to buy cards at several stores to avoid single-store limits
- Follow-up reimbursement variant: scammer sends a fake reimbursement email to stall while codes are redeemed
How to verify before you act
Verify any unusual financial request from a manager by calling them on their known work number — not by replying to the message you received. If you cannot reach them, contact another colleague who would be aware of their schedule.
Check the sender's email address character by character. Legitimate internal requests will come from the organisation's official domain. A slight variation (e.g., an extra letter, a different top-level domain) is a reliable indicator of fraud.
Payment methods used
- Gift cards (iTunes, Google Play, Amazon, Steam, etc.)
- Cryptocurrency
- Wire transfer
Who is usually targeted
- Administrative assistants and executive assistants
- Finance and accounts-payable staff
- Employees at small-to-medium businesses
- New employees unfamiliar with internal processes
- Remote workers who cannot easily walk over to verify in person
What to do immediately
- Do not purchase any gift cards based solely on a message instruction
- Call your manager or the named executive directly on their known work number
- If you have already purchased cards, do not send the codes — keep them and report to your manager immediately
- If codes were already shared, report to your IT or security team and to the relevant gift card issuer
- File a report with your national fraud authority
- Alert HR and your manager so the organisation can warn other staff
How to prevent it
- Establish a company-wide policy that gift card purchases must be verified by phone before any codes are shared
- Train all staff to recognise the pattern: urgent text or email from an executive asking for gift cards
- Check the sender's email address carefully for subtle variations from the official domain
- Call the person directly on their known number before acting on any financial request received only by message
- Never send gift card codes by email, text, or photo
- Report suspected attempts to your IT security or compliance team immediately
- Remind employees that a genuine executive will not mind a brief verification delay
Evidence to preserve
- Screenshot of the original email or message, including sender address
- Any reply chain that followed
- Receipts for any gift cards purchased
- The codes themselves if not yet sent
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Why would a real business ever use gift cards as a payment method?
Legitimate businesses almost never ask employees to personally buy gift cards and send the codes. If there is a genuine business need involving gift cards, it would go through a formal procurement process — not an urgent text to an individual employee.
My manager's exact name and title were in the message. Does that mean it is real?
Names and titles are publicly available on company websites and LinkedIn. Any scammer can research and use them. Only the email address and a confirmed phone call can verify the sender's identity.
Will my employer reimburse me if I fell for this?
Policies vary by organisation. Report it immediately regardless — some companies do provide partial reimbursement, and reporting helps protect other colleagues from being targeted.