The boss gift card scam is a workplace impersonation fraud in which criminals send emails or text messages to employees while pretending to be the employee’s manager, director, CEO, or another senior figure within the organisation. The message requests that the employee purchase one or more gift cards — typically Google Play, iTunes, Amazon, or Steam — and share the redemption codes, with the promise that the employee will be reimbursed once the urgent need is resolved.

The boss gift card scam is a variant of business email compromise fraud — a broader category that costs businesses globally billions of dollars annually. Unlike more complex BEC attacks that involve invoice fraud or wire transfer manipulation, the boss gift card scam is simple, low-cost to execute, and highly scalable. A criminal with a list of company employees, a manager’s name, and basic knowledge of the organisation’s structure can launch dozens of attempts simultaneously at virtually no cost.

The boss gift card scam exploits the gift card payment mechanism for the same reason every gift card scam does — gift cards are immediate, anonymous, irreversible, and universally accessible. Once an employee shares the codes with a scammer, the money is gone. The bank cannot reverse it, and the police cannot easily trace it. The codes are redeemed within minutes through anonymous online accounts, converted to cash, and distributed through criminal networks before any investigation can begin.

Almost every boss gift card scam follows the same six-stage pattern, from the first piece of research to the moment the codes are redeemed.

Step 1: Research and Target Selection

The boss gift card scam begins with research. The criminal identifies a target organisation and collects publicly available information about its structure — typically through the company’s website, LinkedIn profiles, and any public company information. From this, they pick a senior figure to impersonate — ideally the CEO or managing director — and an employee to target, usually someone in an administrative, finance, or executive assistant role who would plausibly receive requests from senior management. Some operators skip targeted research entirely and send mass messages to employees using addresses harvested from data breaches, and the boss gift card scam still succeeds often enough to be profitable at scale.

Step 2: The Fake Message Arrives

The employee receives an email or text that appears to be from their boss. It is typically sent from an address designed to look like the executive’s genuine address — a free email account using the executive’s name (john.smith@gmail.com instead of john.smith@company.com), or a domain spoofed to look almost identical to the company’s (company-corp.com instead of company.com). In some cases the criminal has actually compromised the executive’s genuine account. The message is brief, informal, and urgent: “Hi [name], I’m in a meeting and need your help urgently. Can you purchase some gift cards for me? Are you available?”

Step 3: The Initial Exchange and Trust Building

When the employee responds, the boss gift card scam operator continues with a plausible explanation — the executive needs gift cards as client appreciation gifts for a meeting today, the corporate account has a processing issue, cards are being collected for a company charitable event, or the executive is travelling and needs them for business use. The explanation is designed to be just plausible enough for an employee who trusts their manager to accept without excessive questioning.

Step 4: The Gift Card Purchase Request

The boss gift card scam then makes the specific purchase request — one or more gift cards of a particular brand and denomination. Common brands are Google Play, iTunes, Amazon, Steam, eBay, and Walmart, usually $100 to $500 per card, with total requests of $200 to $2,000. The employee is asked to buy the cards with their own money against a promise of reimbursement, and is told not to discuss it with colleagues — framed as a confidentiality requirement for the business purpose.

Step 5: Sharing the Codes

Once the cards are bought, the employee is told to photograph or type the redemption codes from the back and send them to the email or phone number being used in the fraud. The moment the codes are shared, the boss gift card scam is complete — they are redeemed within minutes through anonymous accounts, and the balance cannot be recovered.

Step 6: The Escalation and Discovery

After the first codes are shared, the boss gift card scam frequently escalates with a request for more cards for the same purpose, and some employees make several purchases before becoming suspicious. Discovery typically comes when the employee mentions the purchase to their genuine manager or a colleague and learns the request was never real — by which point the codes are long redeemed and the loss is permanent.

The boss gift card scam is not a single fraud but a family of related variants — each boss gift card scam variant works a little differently. These are the five most common.

The Office Manager and the CEO Email

An office manager at a mid-sized marketing agency received an email from what appeared to be her CEO’s address. The message said he was in a client meeting and needed her to buy $800 in Google Play gift cards for a client appreciation gift that had been forgotten in the rush of the day — buy them from a nearby shop, text the codes, reimbursement that afternoon. She purchased eight $100 cards and texted the codes as instructed. When the genuine CEO returned and she mentioned reimbursement, he had no knowledge of the request. The email had come from a domain one letter different from the genuine company domain — a detail she had not noticed. Her employer compassionately covered $500 of the loss, but the remaining $300 came from her own pocket — a typical boss gift card scam outcome.

The Finance Assistant and the Multiple Purchases

A finance assistant at a construction company received a text from an unknown number claiming to be the managing director, explaining he had left his work phone at the office and was using a temporary number while travelling. He needed iTunes gift cards purchased urgently for a business gift — $500 worth, codes shared. She bought the cards and shared the codes. The “MD” then asked for a further $500, explaining the client needed more, and she made a second purchase. When she attempted a third at the shop, the cashier — recognising the pattern — asked whether she was being asked to buy these by someone she had not met in person. She called the MD’s genuine office number and discovered the fraud. She had lost $1,000 to the boss gift card scam before the cashier’s intervention prevented a third purchase.

The New Employee Who Did Not Want to Question Her Boss

A recently hired administrative assistant received an email appearing to come from her department director — whose communication style and address she was still learning. The message asked her to buy Amazon gift cards worth $400 for a team recognition award needed today, explaining the normal procurement process was too slow. As a new employee, she was particularly reluctant to question a senior colleague, worried about appearing unhelpful in her first weeks. She bought the cards and emailed the codes. When she later submitted the expense claim, the director had no knowledge of the request. The boss gift card scam had specifically exploited the professional insecurity of a new employee — targeting the person least likely to push back.

The boss gift card scam has attracted specific warnings from the FTC, the FBI, and consumer protection bodies in both the US and UK — all delivering the same core message about the boss gift card scam.

The Federal Trade Commission published a specific consumer alert in January 2026, warning employees that scammers pretend to be bosses asking them to buy gift cards. The FTC’s guidance is unequivocal: no legitimate employer will ever ask an employee to purchase gift cards with personal funds for any business purpose. The FTC notes that the tactic runs year-round, not just over the gift-giving holidays, and that the workplace trust dynamic makes it particularly effective. Report and review guidance at consumer.ftc.gov/scams and reportfraud.ftc.gov.

The FBI’s Internet Crime Complaint Center documents business email compromise — of which the boss gift card scam is the most common consumer-facing variant — as one of the highest-loss cybercrime categories, costing businesses billions of dollars annually. The IC3 accepts reports at ic3.gov and encourages employees to report suspicious gift card requests even if no money was lost.

Action Fraud in the UK documents the scam as a significant and growing category of workplace fraud, noting that remote working — which has reduced opportunities to physically verify requests with colleagues — has made the impersonation easier to sustain. Report UK workplace fraud at actionfraud.police.uk or call 0300 123 2040.

The Better Business Bureau has documented the scam extensively through its Scam Tracker and publishes regular alerts about new campaigns, at bbb.org/scamtracker.

Always Verify Unusual Requests Through a Different Channel

The single most effective protection against the boss gift card scam is verifying any unusual request — particularly one involving money or gift cards — through a completely different communication channel from the one it arrived through. If the request came by email, call the executive on their known phone number. If it came by text, message them through the company platform. Do not reply to the original message, do not use any contact details it provides, and do not assume a matching address or display name is proof. This one step defeats the boss gift card scam every time.

Know That No Business Purpose Requires Employee-Purchased Gift Cards

This rule has no exceptions. No legitimate business scenario requires an employee to buy gift cards with personal funds and share the codes with a manager. Genuine corporate gift-giving runs through official procurement, company accounts, and authorised suppliers. Any request that bypasses those processes is either the boss gift card scam or a serious policy violation to escalate to HR — not to comply with.

Always Check the Full Email Address

Train yourself to check the complete sender address — not just the display name — before responding to any email involving money, gift cards, or sensitive information. The scam relies on employees not looking past the display name. Make it a habit to click the sender name to reveal the full address on any urgent or unusual request. This is the same display-name trick used across the wider family of imposter scams.

Create a Workplace Policy and Share It

If you are a business owner, manager, or HR professional, create a clear written policy stating that gift card purchase requests from management — particularly by email or text — must always be verbally verified before any purchase. Share it with all employees and specifically brief new starters on the boss gift card scam pattern. The best organisational defence is ensuring every employee knows the scam exists and knows they are explicitly permitted and encouraged to verify such requests.

Empower Employees to Question Requests Without Fear

The boss gift card scam specifically exploits the reluctance of employees — particularly junior or new ones — to question requests from senior management. Build a culture where verifying unusual requests carries no fear of appearing difficult. Make it explicit that questioning any unusual money request is not just acceptable but expected. An employee who calls the CEO to verify a $500 gift card request is protecting the company, not being obstructive.

If you have received a boss gift card scam message — or already bought cards because of the boss gift card scam — act quickly. The steps below limit the damage and protect your colleagues.