Why new employees get the "quick favour" gift-card email

It is one of the oldest business email scams, and it still works because it is short and polite. A message “from the CEO” to someone who joined last week, usually in three steps:

A composite example. The “CEO” writes from a personal-looking address, not the company domain.

The attacker does not need to break into anything. A public job announcement and a guess at the email address format are enough to pick the target and write the first message.

Gift card codes behave like cash that can be sent by photo. Once the numbers are read out, they can be redeemed or resold within minutes, and there is no bank transfer to recall. The US Federal Trade Commission puts it plainly: only scammers tell you to buy a gift card and give them the numbers, and no real business or government agency will ask for payment that way.

• "Are you at your desk?" or "Are you available?" from a senior person who would not normally ask.
• A sender address that is not the company domain, or is a free webmail account with the boss's name.
• A request to buy gift cards, of any amount, for any reason.
• Secrecy - "keep it between us", "it's a surprise".
• A reason they cannot be called - meetings, a flight, a bad line.

Every element of the message can be made plausible except one: the attacker needs the employee not to mention it to anyone. A single question to a colleague - “did the CEO really ask for gift cards?” - ends the scam. That is why the script almost always includes a reason for discretion: a surprise for clients, a confidential deal, a reward for the team.

So the most useful thing to teach is not “spot the fake”, which is hard for someone who has met the CEO twice. It is “any request to keep a payment quiet is a reason to tell someone”, which is easy, and works whoever wrote the message.

Payroll diversion deserves a special mention: the message looks like it comes from an employee asking HR to update their bank account before payday. It is quiet, small and repeats every pay cycle until someone notices the real employee was not paid.

Two sentences in the first-day welcome do most of the work:

1. 1Nobody here will ever ask you to buy gift cards, by email, text or chat. If anyone does, it is a scam - tell us.
2. 2If a request from a manager feels odd, check with them in person or on the company chat. Nobody minds being asked.

Back it up with

• An expenses policy that simply has no path for buying gift cards on behalf of someone else.
• A clear place to report suspicious messages, and a habit of thanking people who use it.
• Protecting the new person's mailbox before they start receiving mail.

The scam borrows a manager's authority, so managers are in the best position to take it away. Three small habits make an impersonation obvious:

• Say it first. In the first week, tell new reports directly: “I will never ask you to buy gift cards or send money by email. If something looks like it is from me and asks for that, it isn't.”
• Use one channel for requests. If real requests always come through the company chat or a ticket, an email from a personal-looking address stands out.
• Thank people who check. When someone asks “was this really you?”, the response they get decides whether they ask next time.

A genuine urgent request from a manager survives a ten-second check. A fake one does not. Making that check normal, rather than awkward, is the whole defence.

1. 1Contact the gift card company straight away and ask whether the funds can be frozen. Keep the cards and the receipts.
2. 2Stop replying to the attacker.
3. 3Report it - in the US to the FTC at ReportFraud.ftc.gov.
4. 4Tell the employee it was not their fault. A blame-free response makes the next report faster.