Gift card scams aimed at your staff: "It's the boss, I need a favor"

The text arrives mid-morning, from a number that isn't saved but a name that is:

Hey, it's Mike. Are you at your desk? I'm in a meeting and can't talk. I need you to pick up some Apple gift cards for a client today, five at $200. I'll pay you back this afternoon. Scratch off the backs and send me the codes.

It isn't Mike. But it reads like Mike, it's urgent, and the person receiving it wants to be helpful. By lunchtime, $1,000 of gift card codes are gone, and there's no getting them back.

Why gift cards

Because once someone has the card number and PIN, the money is as good as cash and almost impossible to trace or reverse. That's why the Federal Trade Commission's advice is blunt: no real business or government agency demands payment in gift cards, and only scammers tell you to buy a gift card to pay them.

Why it works on good employees

• It uses a real name. Your website, LinkedIn and social media list who's in charge. The scammer doesn't need to hack anything to know your manager is called Mike.
• It blocks the obvious check. "In a meeting, can't talk" stops the employee from calling.
• It sounds plausible. Owners do send staff to buy client gifts.
• It rewards helpfulness. The people most likely to fall for it are the ones who go the extra mile.
• It moves to text. Scams have shifted to phones, where there's no email filter. In Verizon's 2026 phishing tests, attacks by text and phone call got 40% more clicks than email (Verizon 2026). And with AI able to copy a voice from a short recording, the "call" can sound like Mike too. See cloned voices and the call-back rule.

The rule that stops it

Nobody at this business ever buys gift cards, sends money or changes payment details because of a text, email or call, without first confirming with the person on a number already saved in their phone.

Then say the part that makes it work: the boss will never be annoyed by a call to check. Staff fall for this because they're afraid of seeming slow or questioning the owner. Take that fear away out loud.

Make it concrete:

1. Tell every employee about this scam by name, with the example above.
2. Put the rule in writing, in your handbook or on the wall by the register.
3. Agree on the real channel: "If I need something bought, I'll call you, or ask in person."
4. Praise the first person who checks. That's how the rule sticks.

The same rule covers the calls claiming your business is about to be removed from Google. See scam calls saying your Google listing will be removed.

If someone has already sent the codes

1. Call the gift card company immediately, using the number on the back of the card or on the company's own website. Tell them the card was used in a scam and ask whether they can freeze the funds and refund them. The FTC notes some companies can and do. Keep the receipts and the cards.
2. Report it at ReportFraud.ftc.gov, and to the FBI at ic3.gov.
3. Don't blame the employee. They were targeted by professionals. Use it as the example that teaches everyone else.
4. Check how they got the number. If the scam came by email, or knew things only your staff would know, check whether an email account was taken over. See what to do when a work email is hacked.

What it costs, against what's at stake

	What it comes to
Our Business plan for five people	$870 a month, including regular short training so staff recognize these scams, and email security for the email version
A typical gift card scam	Hundreds to thousands of dollars, usually gone for good
The same trick aimed at a wire transfer	About $123,000 on average for email payment fraud, by the FBI's 2025 figures
The employee who fell for it	Often embarrassed enough to leave

Next steps

1. Tell your team about this scam this week, using the example above.
2. Write down the call-to-confirm rule. Our free payment change verification procedure covers the money side.
3. Read security awareness training that works, or book a free Security Check.