A staff member receives a text that appears to come from the owner or manager. The sender says they are in meetings and cannot take a call. They need several gift cards bought straight away and want the card numbers sent by text.
The request may sound believable because it uses a real person's name and creates pressure. It is a form of impersonation scam.
Once the employee sends the gift card numbers, recovering the money can be difficult. The real owner or manager may know nothing about the request.
Why this scam works
The scammer is trying to stop the employee from checking. They may use authority, urgency or praise to make the request feel important.
A typical message appears to come from a manager, asks for gift cards, money or private information and claims the matter cannot wait. It may also tell the employee to keep the request private or say the sender cannot speak by phone.
The message may arrive by text, email or a messaging app. The details change, but the pressure is the same: act now and verify later.
How to handle an unusual request
Check using a trusted contact method
Call the person on a number already saved in your contacts or speak to them in person. Do not use a phone number or link supplied in the suspicious message.
If the person cannot be reached, wait. A genuine request can be confirmed before money or information changes hands.
Treat gift card requests as suspicious
Gift cards are easy for scammers to use and hard for victims to recover. Staff should never buy them for a work request without following an agreed approval process.
Slow the conversation down
Urgency is a warning sign, not a reason to skip checks. Read the message again and ask whether the request fits the person's normal behaviour and the business's usual process.
Ask someone else
Show the message to a manager, colleague or IT provider. A second person may spot a changed email address, unusual wording or a request that does not make sense.
Report the message
Tell the person being impersonated and your IT provider. If anyone has already sent money, gift card details or account information, contact the relevant bank or gift card provider immediately and follow professional advice.
Give staff a simple rule
Every business should have a clear rule for payments, gift cards and changes to bank details. Staff should know who can approve a request and how to verify it.
Want one clear rule for staff? Ask JCPIT about a payment-verification review. We will confirm the scope before reviewing approval steps, reporting paths or account protections.
