The Gift Card Request From the Boss

Why this matters

The text arrives from a number the office does not recognize, signed with the owner's first name, asking for a quick favor. Within the hour a loyal, careful office manager has bought several gift cards, scratched off the backs and sent photos of the codes to a stranger. This scam is old, boring and still works on shops every week, because it is aimed at exactly the trait you hired for: someone who gets things done for the owner without being asked twice. The fix is not smarter staff. It is one sentence from the owner, said out loud, before the text ever comes.

The pattern, as it actually reads

Every version follows nearly the same script. This one is typical:

FAKE OWNER: Hey are you at your desk? This is Mike,
            on my other phone. In a meeting till 3.
OFFICE:     Hi Mike, yes. What do you need?
FAKE OWNER: Need a favor, quick. Want to send
            thank yous to a couple of our best
            customers. Can you grab gift cards on
            your way out? I'll pay you back today.
OFFICE:     Sure, how many?
FAKE OWNER: 6 of them. Same store brand. Scratch
            the back and text me pics of the codes
            so I can send them right away.
OFFICE:     Got 4, the register limit stopped me.
FAKE OWNER: Ok send those now. Try another store
            for the last 2. Please keep this
            quiet, it's a surprise.

Look at what each line is doing. "My other phone" explains the strange number before anyone asks. "In a meeting till 3" closes off the obvious move, which is to call him. "Quick" and "right away" set a clock. "Thank yous to customers" makes it sound like something the owner would plausibly do. "I'll pay you back" tells the office it is their money, which oddly makes people more willing, because it feels like a personal favor rather than a company expense. "Scratch the back and text me pics" is the actual theft: the codes on a gift card are the money. And "keep this quiet, it's a surprise" stops the one thing that would end it, which is mentioning it to a co-worker.

The scammer got the owner's name from the website, the office manager's name and mobile number from a business profile, a social media post, or a data broker that sells work contact details. No hacking is required.

Why it works on your best people

Authority plus helpfulness. The office manager's job is to make the owner's day easier. Questioning a request from the boss feels like the opposite of the job. People who are slow and suspicious about requests are rarely the people you promote to run the office.

The ask starts small and arrives one step at a time. "Are you at your desk?" is harmless to answer. Each reply commits the person a little further, and by the time the request is strange, they have already agreed to help.

The channel is locked. The meeting, the dead phone, the flight that is boarding: every version gives a reason the owner cannot take a call. That is the tell, and it is the same tell in every money request that is not real: it removes your ability to check.

Secrecy isolates the target. A surprise for customers is a reason not to tell the co-worker at the next desk, who would have said "Mike never does that."

Gift cards are the perfect payment. Once a code is sent, it can be spent or resold in minutes, it is tied to no identity, and there is no bank on the other end obliged to investigate. That is why the scammer wants cards and not a wire.

Notice what is not on this list: the person being foolish. Shops that respond to the first incident by calling the employee careless get two outcomes. The person who was fooled stops reporting things, and everyone else learns that the safe move is to never mention a mistake.

The one-sentence policy

The owner writes this down and says it, in person, to every person in the office and every new hire:

"I will never ask you by text or email to buy gift cards, send money, or change anyone's payment details, and if anything that looks like me asks, call me on the number already in your phone before you do anything, and you will never be in trouble for checking."

Each clause has a job. "Never by text or email" gives staff a rule they can apply without judgment, which is what you want under time pressure. "Gift cards, send money, payment details" covers the three forms the request takes. "The number already in your phone" sends them to a channel the scammer does not control, rather than a number in the message; the general version of that habit is owned by see related: The Verify-on-a-Second-Channel Rule. And "never in trouble for checking" is the clause that makes the rest work, because the real cost the employee is weighing is annoying the owner in a meeting. Remove that cost and the rule holds.

Then the owner has to keep it. If the owner ever does text the office asking for a gift card run, even once, as a real request, the policy is gone. The employee can no longer tell a real request from a fake one by its form.

Worked example: a Thursday afternoon at a plumbing shop

An eleven-person plumbing shop, owner on a job site, office coordinator alone at 1:40 on a Thursday. The text exchange runs close to the script above. The coordinator buys 4 cards at one store, hits the store's per-transaction limit, and sends photos of all 4 codes at 2:05. On the way to a second store she mentions it to the dispatcher by text, who replies within a minute: "That's not Mike, he's on the Oak Street job, his phone is fine."

2:08, she stops. She calls the owner on his saved number. He picks up. It was not him.

2:10, she calls the phone number on the back of each card, for the company that issued it, with the receipts and the card numbers in hand. The FTC's guidance is to contact the issuing company immediately and ask whether the funds can be frozen. The answer is per card: of the 4, two had already been redeemed in the 5 minutes between the photo at 2:05 and the call at 2:10, and two still showed their full balance and were frozen. So half of what was spent came back, entirely because the dispatcher answered in one minute and the coordinator called in two more. Twenty minutes later, all four would likely have been gone.

2:25, she keeps the evidence. Screenshots of the full text thread with the sending number, the receipts, the card numbers, the time of each step. She reports it at the FTC's fraud reporting site and forwards the scam texts to 7726 (SPAM) to report the number to her carrier.

3:00, the owner decides on the money. The coordinator bought the cards on her personal card, believing she would be paid back. The owner reimburses her the full amount, including the two cards that could not be recovered. This is a policy choice, not a requirement, but it is the cheap one: an employee who loses their own money for trying to help the owner is an employee who will not help next time, and who will not report the next attempt.

The next morning, the owner says the policy sentence at the morning huddle, to everyone, office and techs both. Techs get these texts too, and some carry company cards.

What would have changed the outcome: had the coordinator used a company card for the purchase, the recovery path would be the same issuing-company call, but the loss lands on the shop directly. Had she sent the codes and told nobody, the first anyone would have heard of it was the owner asking at 4:00 why she bought gift cards, by which time every code would be spent.

Making the target harder to find and slower to pay

The policy is the control that works. Three smaller habits shrink how often it gets tested, how much a miss costs, and how fast you learn from it.

Take personal mobile numbers off public pages. The scammer needs a direct line to one person, ideally a mobile, so that the text lands outside any shared inbox a colleague might see. Check the website's team page, business profiles, social posts and any trade directory listing. Where a contact has to be public, use a role address or the main office line. This will not stop the shop's numbers appearing in data-broker lists, but it removes the easiest source.

Put a speed bump on company cards. Many business card programs let the owner set a per-transaction limit and block or flag gift card purchases at the issuer level, and some send an instant alert to the owner on any purchase over a set threshold. An alert that reaches the owner's phone while the office manager is still in the store line is a second chance at the 2:08 moment in the example above. It is a backstop, not a substitute: a determined scammer simply asks the employee to use their own card, as in the example.

Log every attempt, including the ones nobody fell for. A one-line entry (date, who received it, which name was impersonated, the sending number) costs a minute. Three attempts in a month aimed at the same person tells you where that person's number is published, and it gives the next new hire a real example to read.

When the request does not look like this

The request comes as a voice call in the owner's voice. A short recording from a voicemail greeting or a video is enough to imitate someone now. The policy sentence still holds, because a real call can also be hung up and returned on the saved number; the specific handling belongs to see related: Voice Cloning and the Urgent Call From the Owner.

The text comes from the owner's real number or real email. If the owner's own account or phone number has been taken over, the "unfamiliar number" tell disappears. The policy still works, because it does not depend on the sender looking strange, only on the request type. If a request arrives from the owner's genuine address and the owner says it was not him, that is a breach to handle immediately; see related: The First Hour After a Suspected Breach SOP.

It claims to be a supplier, not the owner. "We've changed banks, please update our details" is the same scam aimed at accounts payable. The policy sentence covers it with "change anyone's payment details", and the procedure is owned by see related: The Vendor Bank Detail Change SOP.

References

• Federal Trade Commission, consumer guidance on gift card scams and ReportFraud.ftc.gov
• FBI Internet Crime Complaint Center (IC3), business email compromise and impersonation advisories
• See related: The Verify-on-a-Second-Channel Rule, Voice Cloning and the Urgent Call From the Owner, Training the Office to Spot Social Engineering Calls