"My Boss Asked Me to Buy Gift Cards": The Christmas Impersonation Scam and How to Stop It

It usually starts with something short and friendly: "Are you at your desk? I need a quick favour." It appears to come from the managing director, by email or WhatsApp. A few messages later: "I'm stuck in meetings all day. Can you buy six £100 Amazon gift cards for client Christmas presents? Scratch off the codes and send me a photo. I'll sort the expenses later."

It's one of the most common scams aimed at small business staff, and it peaks between November and Christmas, when gift cards for clients and staff sound completely normal. The same trick is used for urgent bank transfers and changes to bank details.

What the Scam Looks Like

• Gift cards for "client presents" or "staff rewards", usually Amazon, Apple or Google Play, with a request to send the codes or a photo of the cards.
• An urgent payment to "a new supplier" that must go out before the office closes for Christmas.
• A change of bank details, either for a supplier, or from an employee asking HR to change where their December salary is paid.
• A WhatsApp from a new number using the boss's real photo: "This is my new number, I'm in a meeting, can you do something for me?"

How to Spot It

• Check the actual email address, not just the name. Scammers use a free email account, or a lookalike domain with one letter changed.
• Urgency and secrecy: "I need this in the next hour", "keep it between us, it's a surprise".
• They can't talk: always in a meeting, on a flight or at a funeral, so you can't call to check.
• Anything involving gift card codes. Genuine businesses don't pay or reward anyone by sending codes in a message.
• A tone that's slightly off: unusually formal, or not how that person normally writes.

What to Do If You Receive One

1. Don't reply and don't click any links.
2. Check with the person directly: in person, or by calling a number you already have, never one in the message.
3. Tell your IT support or manager, as others in the team have probably had the same message.
4. Report it: forward phishing emails to report@phishing.gov.uk, and scam texts to 7726.

If You've Already Bought the Cards or Sent the Codes

Act quickly. Scammers usually spend the balance within minutes, but not always.

1. Contact the gift card company immediately through its official website or app, with the card numbers and receipts. If the balance hasn't been spent, it can sometimes be frozen.
2. Tell your manager and IT support, and keep every message, email and receipt.
3. Report it to Action Fraud, the UK's national fraud reporting service (in Scotland, Police Scotland on 101).
4. If you paid with a card or made a bank transfer, call the bank on 159 straight away.

Nobody should be blamed for falling for this. These messages are designed by professionals to look genuine, and fast, blame-free reporting is what limits the damage.

How to Protect Your Business

• Make a simple rule and tell everyone: gift card purchases, urgent payments and changes to bank details are always confirmed by phone or in person, using a known number. No exceptions, even for the boss.
• Turn on external email warnings, so emails from outside the business show a clear banner. Microsoft 365 and Google Workspace both support this.
• Turn on impersonation protection. Microsoft Defender for Office 365, included in Business Premium, can flag emails pretending to be your directors.
• Set up SPF, DKIM and DMARC so criminals can't send email that looks like it comes from your exact domain. Check yours with our free email security checker.
• Train the team, especially finance, HR and assistants, who are targeted most. See our security awareness training.
• Protect accounts with MFA, because the most convincing version comes from a director's real account after it's been hacked.

How We Handle It

We set up the protections that stop these emails reaching staff, including external sender warnings, impersonation protection and DMARC, and train teams to spot the ones that get through. If someone has already sent codes or money, we help you work out what happened, check whether an account was compromised and lock everything down. See our cyber security services, or get in touch.

Related Reading

• How to Spot a Phishing Email
• Christmas Shutdown IT Checklist
• Microsoft 365 Account Hacked and Sending Spam