Stop CEO Fraud
A message from your CEO — or a convincing lookalike address — says they are in a meeting and need you to buy gift cards right now, scratch off the codes, and send photos. It feels urgent and important, which is exactly the point. This is CEO fraud (a form of business email compromise): criminals impersonate executives to trick employees into sending money or gift cards. No real executive operates this way. Ever.
TL;DR / Quick Fix
Quick fix: your 'boss' urgently asking for gift cards is always a scam — real executives never request payment that way. Buy nothing; verify by calling your boss on a known number. Report the message to IT, then delete it. Urgency is the weapon — slowing down defeats it.
Follow these steps
- Recognize the pattern instantly. Urgent request from an executive, unusual payment method (gift cards, wire, crypto), secrecy (do not tell anyone), and a deadline of now. Any two of these together mean scam — it is the same playbook as gift card payment scams aimed at consumers.
- Stop. Do not buy anything. Do not go to the store, do not open the gift card site, do not send codes. The entire attack depends on you acting before thinking — breaking that chain at step one ends it completely.
- Verify through a separate channel. Call or message your boss on a number you already have — not a number in the suspicious message. A thirty-second call (Is this really you asking for gift cards?) resolves it with certainty. Watch for lookalike email addresses while you are at it.
- Report it to IT or security. Forward the message to your IT/security team before deleting it. They can warn the whole company, check whether the executive's account is compromised, and block the sender domain.
- Warn your colleagues. These attacks go out in batches — if you got one, coworkers probably did too. A quick heads-up in the team channel (this is going around, do not fall for it) protects people the scammers have not reached yet.
- Know what to do if you already paid. Call the gift card company's fraud line immediately — some codes can be frozen if unused. Then report to IT and the police. Act fast and do not let embarrassment slow you down; these scams fool careful people every day.
What NOT to do
- Do not reply to the message, even to say no. Any reply confirms a live, responsive target — report and delete instead.
- Do not buy the cards to check if it is real. There is no version of this that is legitimate — testing it with real money is just paying the scammer.
- Do not keep it secret out of embarrassment. Reporting protects everyone; silence protects only the scammer's next target.
- Do not trust contact details inside the suspicious message. Scammers staff the phone numbers and reply addresses they plant — use contacts you already had.
Frequently asked questions
What if it came from my boss's real email?
Their account may be compromised — which makes the out-of-band verification even more critical. Tell IT immediately so they can secure the account.
I already sent the codes — can I get the money back?
Call the gift card issuer's fraud line at once; unused codes can sometimes be frozen. Then file reports with IT and law enforcement. Speed matters more than anything now.
Can the company be liable?
Policies vary, but companies generally treat employees who followed verification procedures as victims, not culprits — which is why reporting promptly and following the process protects you.