Why criminals want gift cards
From a scammer's point of view, gift cards are close to perfect. They can be bought at any supermarket or service station, the value sits in a short code that can be sent by text, and once the code is used or sold on, there's usually no way to get it back. Unlike a bank transfer, there's no receiving account to freeze and no recall process. That is why gift cards appear in so many scams aimed at businesses. The cards themselves are legitimate products, often from big app stores, streaming services or retailers. What's fake is the reason someone gives for needing them.
The stories scammers use
The most common version uses the owner's name. A staff member gets an email or text: 'I'm in back-to-back meetings and need to sort out gifts for some clients. Can you pick up eight $100 cards on the way in? I'll reimburse you. Scratch the backs and send me photos of the codes.' The tone is friendly and slightly hurried, and the request feels like a small favour.
Other versions pretend to be from IT ('we need a gift card to renew your antivirus licence'), a government agency ('your tax debt can be settled with vouchers'), or a supplier offering a discount for payment in cards. No real business, IT provider or government department settles anything with gift cards. That one fact is the whole defence.
Why staff fall for it
People fall for gift card scams because they want to help and because the amounts seem manageable. A request for a few hundred dollars doesn't trigger the same caution as a large bank transfer. Staff may also worry about letting the boss down or looking unhelpful if they ask too many questions, particularly if they're new.
Scammers also keep people moving. Once the first card is sent, they often ask for more, claiming the first was for the wrong amount or that more clients need gifts. By the time anyone stops to check, several hundred or a few thousand dollars may be gone, often from the staff member's own pocket.
The office rule that stops it
Make a clear, written policy: the business never asks staff to buy gift cards for payment, gifts or any other reason by email, text or chat. Any genuine gift card purchase is arranged in person and paid with a company card, with a receipt. Include it in induction for new starters, because new staff are a favourite target before they know how the office works.
Back it up with the same verification habit used for other money requests. If anyone receives a gift card request, they stop, don't reply to the message, and confirm with the supposed sender by calling their known number or asking them face to face. A short note in the staff kitchen or on the intranet is a useful reminder.
If a staff member has already sent codes
Act quickly. Contact the gift card company straight away using the details on the card or their official website; some can freeze a card if the balance hasn't been spent. Keep the cards and receipts. Report the scam to the police and the NCSC, and forward the original email or text so it can be investigated.
Then deal with the staff member kindly. They were deceived by professionals, and shaming them makes others less likely to report mistakes. Decide as a business how you'll handle any personal loss, and use the incident, anonymously if they prefer, as a real example for the rest of the team.
Spotting the request before anyone shops
Gift card requests share a few features that are easy to teach. The sender is unusually vague about who the gifts are for, wants the cards bought from a particular store or brand, insists on photos of the codes rather than the cards themselves, and becomes impatient if questioned. Often the first message arrives from a personal webmail address or an unknown mobile number with the boss's name attached.
Ask staff to look at the channel as well as the content. If the owner normally talks to them in person or on Teams, a sudden text from a new number asking for a favour is out of character. That mismatch alone is reason enough to pause and check before spending a cent. Staff who report a request like this should be thanked publicly, so the next person feels comfortable doing the same.
In short
- No real business, IT provider or government agency asks for payment in gift cards.
- A request to send gift card codes by text or email is a scam.
- Write a 'we never pay with gift cards' rule and include it in induction.
- Confirm any unusual request from a manager by calling their known number.
- If codes were sent, contact the card company immediately and report it.