The gift card scam: why it still works on busy offices

The anatomy of the gift card scam

The gift card scam is one of the most common and effective forms of social engineering targeting small businesses today. It is simple, requires very little technical skill from the attacker, and exploits the desire of employees to be helpful and responsive to their leadership. While it may seem obvious to some, the scam continues to succeed because of the psychological pressure the attackers apply.

In this scenario, an employee receives a text or email that appears to be from a senior manager, owner, or CEO. The message usually starts with a simple check-in: 'Are you available?' or 'I need a quick favor.' Once the employee responds, the attacker explains they are in a meeting or otherwise busy and need the employee to purchase several gift cards for a client or employee reward program.

Why attackers choose gift cards

Cybercriminals prefer gift cards for several specific reasons. Unlike wire transfers or checks, gift card transactions are very difficult for law enforcement to track. Once the employee buys the cards and sends photos of the codes on the back, the money is gone. The attacker can then immediately sell those codes on the secondary market or use them to buy high-value items that can be resold.

• Irreversibility: Once the code is shared, the transaction cannot be reversed by the bank or the gift card issuer.
• Anonymity: Gift cards do not require a bank account or identification to use, making the attacker hard to find.
• Accessibility: Gift cards can be purchased at almost any grocery store or pharmacy, making it easy for the victim to comply quickly.

The psychological tactics of the gift card scam

The success of the gift card scam depends on psychological manipulation rather than technical hacking. Attackers use three main levers to control the victim: urgency, authority, and secrecy.

By telling the employee not to call, the attacker prevents them from verifying the request. By promising reimbursement, they lower the employee's financial concern. And by pretending to be the boss, they ensure the employee feels a sense of duty to complete the task.

How to identify a gift card scam in progress

Training your staff to recognize the signs of a gift card scam can save your business thousands of dollars. There are several consistent red flags that appear in almost every version of this attack.

1. The request comes from an unusual number or a personal email address rather than a work account.
2. The sender insists on communicating only via text or email and makes excuses for why they cannot speak on the phone.
3. There is an extreme sense of urgency, often with a 'deadline' only a few hours away.
4. The request involves a specific type of payment that the business does not typically use.

Protecting your office from payment fraud

The best way to stop the gift card scam is to create a culture where employees feel safe questioning unusual requests. You should also have formal policies for how company funds are spent and how reimbursements are handled.

• Explicitly state in your employee handbook that the company will never ask an employee to use their own money to buy gift cards for the business.
• Create a 'verification first' culture where it is standard practice to call a manager back on a known number to confirm an unusual request.
• Educate staff on the common scripts used by scammers so they can recognize them instantly.
• Use internal communication tools like Slack or Microsoft Teams for official requests rather than SMS.