The gift card scam that keeps catching out small business staff
The gift card scam is one of the oldest tricks in the fraudster's playbook, and it still works because it leans on something no software can fully defend against: a person doing the right thing. A customer walks in (or calls, or messages) asking your team to "just grab a couple of gift cards" as a favour, a gift, or as part of a payment. Most staff would say yes to a neighbour. A scammer is betting your team will say yes to a stranger.
Every time that happens, the business eats the loss. Gift cards are treated as cash by scammers: they are untraceable, transferable within minutes, and almost impossible to claw back once redeemed. This is exactly why a simple request for gift cards should always stop a transaction in its tracks.
What is a gift card scam?
In plain English, a gift card scam is any fraud where the victim is pressured to buy or hand over gift cards, and the fraudster collects the PINs or the cards themselves. The mechanics change, but the goal never does: converting your money into something anonymous and gone.
The most common versions include:
- Payment requests. A "customer", a landlord, a tax office, a supplier, or a family member (a voice cloned from a stolen phone number, or a lookalike profile on social media) asks to be paid by gift cards because "bank transfers are frozen" or "I need cash quickly".
- The favour. A caller claims to be from a delivery company, a charity, or a supplier and asks your team to pick up gift cards "on the way" and call back the PINs.
- The overpayment refund. A buyer sends too much, then asks for the difference in gift cards or cash back before the fake payment bounces.
- QR code and terminal traps. Fake QR codes over real payment terminals, or spoofed payment screens, that redirect a customer's tap or scan to the fraudster's account while your till shows a completed sale.
What makes it dangerous is that it is not a technical breach at all. There is no virus, no hacked inbox, no broken firewall. It is a phone call, a message, or a walk in the door, met with a person willing to help.
Why should you care?
Because the person paying for it is you, not the caller.
- Gift cards are irreversible. Unlike a bank transfer, there is no chargeback. Once the PIN is read or the card is redeemed, the value is usually gone forever.
- It targets the friendliest people in the building. Front-of-house, reception, and support staff exist to be helpful. Scammers exploit that exact trait. Your best customer service is your biggest exposure.
- Small business is the sweet spot. Big companies have payment policies, verification desks, and fraud teams. A local shop, clinic, or agency usually relies on one or two people to say no, on instinct, in the moment, under time pressure.
- It compounds with other scams. Gift card requests are often the follow-up to a fake invoice, a fake lead, or a fake supplier. The initial fraud builds trust; the gift card request cashes it in.
The cost is not just the value of the cards. It is the embarrassment, the time spent chasing a recovery that almost never happens, and the lesson that a stranger's urgency was never a good reason to move money.
How Jordan Gall Cybersecurity helps
At Jordan Gall Cybersecurity, we treat fraud awareness as a core part of security, not an afterthought. Our terminal-based phishing simulation training walks your team through the latest real-world fraud patterns, including gift card requests, fake QR code attacks, and spoofed payment screens, in a safe environment where making a mistake is exactly the point.
The training is built for local businesses, not enterprise training departments. It is short, realistic, and repeated, because awareness is a habit rather than a one-off video. We also review your payment and payment-adjacent processes, from point-of-sale to bank transfer approvals, so that the human decision points are the ones actually protected. If a request for gift cards is going to reach your team, we make sure the team knows, by practice, how to respond.
Action steps you can take today
- Set a hard rule: no gift card purchases, PINs, or cash-back for any third party, full stop. If a payment request wants gift cards, treat it as fraud until proven otherwise.
- Give staff a script. A simple, rehearsed response ("We don't handle gift card purchases; I'll have someone call you back") removes the pressure of deciding in the moment.
- Verify out-of-band. If a "known" contact suddenly asks for a payment method change, hang up and call them back on a number you already have. Never use the number on the incoming message.
- Put a QR check in place. Make sure your point-of-sale screens and printed QR codes match, and train staff to spot a sticker or a second code over the real one.
- Run a quick simulation. Test your team with a realistic gift card or fake QR scenario before a real scammer does. See where the process breaks, then fix it while it is free.
Conclusion
The gift card scam keeps working because it is never a fight between your systems and a hacker. It is a test of your people's willingness to say no, calmly, to a request that sounds harmless. If "grab some gift cards for me" has ever sounded like a normal favour, that is the gap a fraudster is looking for.
Close that gap. If you want your team trained on the scams actually hitting local businesses right now, from gift card requests to spoofed QR terminals, reach out to Jordan Gall Cybersecurity for a conversation. The cost of a scam is always higher than the cost of being prepared.