The gift card scam that keeps catching out small business staff

The gift card scam that keeps catching out small business staff

Ask any small business owner, and they'll tell you the same thing: gift cards are cash. When someone says, "Can you grab some gift cards for me?", it's as good as a request to hand over money. But what if that person isn't who they say they are?

That's exactly why this scam is catching out staff — and it's happening more often than most businesses realise.

How the attack works

The gift card scam is a variant of business email compromise (BEC). Here's the playbook:

1. Impersonation: A criminal spoofs an internal email address or uses a compromised account to send a message that looks like it came from someone in authority — a manager, director, or even a supplier.
2. Urgency and secrecy: The message says something along the lines of "I'm on a flight and can't talk right now — just grab some gift cards for me" or "Someone's asking about our product and I need to send them a few as a thank you."
3. The gift card request: The attacker asks staff to purchase prepaid gift cards (often Visa, Mastercard, Amazon, or iTunes) using the company credit card or corporate account.
4. Redemption: The criminal buys the cards online and redeems the balance instantly — often within minutes.

By the time someone notices, the money is gone.

Why it keeps catching people out

The reason this scam works so well isn't because staff are careless — it's because of how human psychology plays into it:

• Authority bias: We're wired to obey requests that look like they come from a boss.
• Urgency: The "I'm in a hurry" angle makes people skip their normal checks.
• Social proof: If the request references a real person or project, it feels more legitimate.
• Low-value framing: A few hundred dollars on gift cards seems trivial compared to wire transfers — but the cumulative loss can be enormous.

The red flags you should never ignore

Here's how to spot this scam before the damage is done:

1. Never send company money via personal gift cards

If someone asks for a purchase to be made with a corporate credit card or business account, that's an automatic red flag. Legitimate requests don't ask staff to bypass normal procurement channels.

2. Verify through a different channel

If your director is asking you to buy something urgent: pick up the phone and call them back on their known number. Don't rely on email alone — especially when it involves money moving out of the business.

3. Check for urgency language

Messages that say "I can't talk right now", "this needs to be done today", or "just do this one thing" are designed to short-circuit your thinking. Legitimate requests don't need secrecy.

4. Look at the sender's details

• Is the email coming from a known address, or something slightly different?
• Does it have typos in the company name?
• Has the sender ever sent this kind of request before?

If anything feels off, stop and verify.

How to protect your business

Implement a gift card policy

Many businesses now forbid the purchase of prepaid cards with corporate funds. It sounds simple, but it's one of the most effective controls against this scam. If you already have such a policy, make sure staff know about it — and that exceptions require manager sign-off via voice or video call.

Train your team on BEC

The gift card scam is just one flavour of business email compromise. Regular training helps staff recognise patterns across all BEC variants — from invoice fraud to CEO impersonation. Short, realistic scenarios work better than long lectures.

Use email authentication

Tools like SPF, DKIM, and DMARC stop criminals from spoofing your domain in emails. When combined with multi-factor authentication (MFA) on all business accounts, the odds of a successful BEC attack drop dramatically.

Monitor spending alerts

Set up notifications for any large or unusual corporate card transactions. A sudden series of small purchases — like five $100 gift cards — can trigger an alert before you lose thousands.

The bottom line

The gift card scam sounds simple, but it exploits the same human weaknesses that make every other social engineering attack possible: trust, urgency, and authority bias. That's why verification is your best defence.

A quick phone call to confirm a request — especially one involving money leaving the business — costs seconds but can save you thousands. Make it part of your culture, and gift card scams stop working against your staff.

---

This article was written by Jordan Gall, cybersecurity expert at Buchanan Technology and founder of JordanGall-Site. Secure365 delivers terminal-based BEC protection through email authentication (SPF/DKIM/DMARC) and MFA — helping local businesses stay ahead of scammers like this one.