Boss/CEO Gift Card Impersonation (BEC) Scam

Overview

Scammers impersonate a company executive or boss via spoofed email, text, or phone call, urgently asking an employee to buy gift cards and send back the codes. It's one of the most common and persistent forms of Business Email Compromise (BEC) fraud.

How It Works

A criminal researches a company's leadership on sites like LinkedIn or the corporate website, then impersonates a CEO, HR director, or other authority figure by spoofing their email address or phone number (sometimes buying breached credentials and contact lists to make the impersonation more convincing). The fake "boss" contacts an employee claiming to be in meetings or traveling and unable to talk, and asks for an urgent "favor": purchasing gift cards (Apple, Google Play, Target, etc.) for clients, staff gifts, or a client reimbursement. The message pressures the employee to act fast and keep it confidential. Once the employee buys the cards, the scammer instructs them to scratch off the back and photograph or text the card numbers and PINs, at which point the funds are cashed out within minutes and the "boss" goes silent.

Red Flags

• Urgent, time-pressured request from a 'boss' or executive asking you to buy gift cards
• Sender claims to be unreachable by phone because they are 'in a meeting' and asks you to just reply to email or text
• Request to send back gift card numbers and PINs (or photos of the scratched-off codes) rather than the physical cards
• Email address or phone number that looks almost identical to the real supervisor's but has a subtle difference (e.g., a swapped letter or different domain)
• Instructions to keep the purchase secret or not mention it to coworkers

Real Examples

• The FBI's Phoenix field office issued a Tech Tuesday bulletin describing BEC scams where a spoofed email or text from a 'CEO or HR director' tells an employee to purchase gift cards for the executive to give away or use for a party, with the employee told to send back the card number and PIN.
• A cybersecurity write-up citing a January 2026 FBI consumer alert titled about bosses asking for gift cards noted that gift card requests are now a common BEC variant, including text requests sent to employees' personal phones, often relying on data harvested from breached accounts to impersonate executives convincingly.
• Proofpoint research found that since March 2020, over 7,000 CEOs or other executives have been impersonated in these schemes, with a single CEO on average impersonated 102 times across a 90-day period.
• An industry analysis reported that gift card schemes represented 37.9% of all BEC incidents in Q1 2024, calling them the top BEC cash-out method.

Where It Spreads

How to Protect Yourself

• Never purchase gift cards based solely on an email or text request, no matter how urgent it sounds or who it appears to be from
• Verify any unusual request by contacting the supposed sender directly through a known phone number or in person, not by replying to the message or calling a number it provides
• Watch for mismatched or spoofed email domains and report suspicious messages to your IT or security team
• Remember that legitimate executives, businesses, and government agencies never ask employees or customers to pay via gift card codes
• Report incidents to the FBI's Internet Crime Complaint Center (IC3.gov) so patterns can be tracked and investigated

Related Scams