The Boss Gift Card Scam: How the CEO Email Con Works (2026)
How the boss gift card con actually works
The CEO gift card scam is a form of business email compromise. A scammer copies your boss’s name onto an email or text, claims to be stuck in a meeting and unable to talk, and asks you to quietly buy gift cards and send the codes right away. No real boss pays for anything with gift cards. If anyone asks you to buy gift cards for work, verify it in person or through a phone number you already trust before you spend a dollar.
The setup is almost boring in its simplicity, which is exactly why it works. A scammer takes the name of someone you report to, your CEO, your manager, the head of your department, and puts it in the display name of an email or a text. The address underneath is a free account the scammer opened that morning, but most people read the name, not the address, and the name says boss.
Then comes the ask. It is always urgent and it is always a little secret. The message says there is a surprise coming, gift cards for a client, a thank you for the staff, a reward nobody is supposed to know about yet, and it needs to happen now. You are told to go buy gift cards, Apple, Google Play, and Amazon are the usual requests, scratch off the backs, and send photos of the codes. Once a code is sent, the money is gone. There is no chargeback on a gift card. That is the whole point of using one.
The reason the boss is never available to confirm is baked into the script. I am in a meeting and cannot talk. I am about to board a flight. My phone is acting up, just email me the numbers. Every line is designed to keep you off the one channel, a live human voice, that would end the con in ten seconds.
Why it works, and who tends to get hit
We like to think we would catch this. Most of us would, on a calm afternoon. But the con is not built for a calm afternoon. It is built for the new hire who does not yet know how the boss actually talks, the assistant whose entire job is to make the boss’s problems disappear quickly, and the finance or accounts person who moves money all day and is used to being told to just handle it.
The pressure does the work. Authority plus urgency plus secrecy is a combination that shuts down the part of your brain that asks reasonable questions. You do not want to annoy the CEO by double checking. You do not want to be slow. You do not want to be the one who made the surprise not happen. The scammer is counting on all three of those feelings, and none of them have anything to do with whether the request is real.
It is worth saying plainly that falling for this does not make you gullible. It makes you someone who wanted to do their job well and got targeted by people who do this full time. The shame that keeps victims quiet is part of how the scam keeps running.
The text I got from a boss I did not have
I got one of these texts once, supposedly from a boss I did not have. It landed on a Wednesday afternoon, the dead part of the week when you are half checked out. The name on it was a plausible executive name, confident and generic, and the message said he was tied up and needed me to grab a few Apple gift cards for a client thing, keep it between us, he would sort out the reimbursement later.
For about four seconds it worked on me. Not because I believed I had a boss named that, I did not, but because the shape of it was so familiar. Urgent, friendly, slightly secretive, a small favor framed as trust. That is the uncomfortable part. The con did not need me to be foolish. It just needed me to be on autopilot for a moment, the way everyone is at two in the afternoon.
What snapped me out of it was the gift card part, not the fake name. The second a request for money routes through a store gift card instead of an invoice or a card on file, the whole thing collapses. No real client gets paid in scratch off codes. I did not reply. I did not click anything. I deleted it and reported the number, and that was the end of it. The rule that saved me is the same one that will save you, and it has nothing to do with being clever.
The one rule that kills this scam
Here it is, and it is the whole article: no legitimate boss, company, or client ever pays for anything with retail gift cards. Not clients, not vendors, not taxes, not bonuses, not emergencies. Gift cards are for gifts. The moment anyone in a position of authority asks you to buy them and send the codes, you are not looking at a business request. You are looking at a scam, every single time, with no exceptions.
So when a gift card request shows up, verify it through a channel you already trust, not the one the message came in on. Call the boss on the number you already have saved. Walk to their office. Message them on the company’s real internal system. Do not reply to the email, do not text the number that contacted you, and do not use any phone number the message gives you, because that number rings the scammer too.
If you confirm and the person is genuinely unreachable, the answer is to wait, not to spend. A real surprise can survive an hour’s delay. A scam cannot, which is exactly why it insists it cannot wait. Treat urgency plus secrecy plus gift cards as the three warning lights they are, and make the request prove itself before your money leaves the building.
What to do if you already sent the codes
First, breathe, then move fast, because speed is the only thing that occasionally gets money back. Contact the company that issued the card right away. The FTC keeps a running list of gift card issuer contacts and their fraud lines, and if the balance has not been drained yet, some issuers can freeze it. Have the card numbers, the receipts, and the time you bought them ready.
Then report it. Tell your actual employer and your IT or security team immediately, because if one person at a company got the message, others probably did too, and your report is what stops the next one. Report the scam to the FTC at ReportFraud.ftc.gov and to the FBI’s Internet Crime Complaint Center at ic3.gov. These reports feed the cases that occasionally shut these operations down.
And keep your receipts and the original message. They are evidence, and they are also the proof that this was a targeted con and not a careless mistake. The people who run this scheme are organized and relentless. The best thing any of us can do is make the next person’s four seconds of doubt last long enough to pick up the phone.
Frequently asked questions
Does a real boss or company ever pay with gift cards?
No. This is the single fact that makes the scam easy to spot. Legitimate businesses pay clients, vendors, taxes, and employees through invoices, payroll, bank transfers, or a company card on file, never by having staff buy retail gift cards and send the codes. If a work request routes through gift cards, it is a scam.
Why do scammers specifically ask for gift cards?
Because gift cards work like cash and cannot be reversed. Once you scratch off the back and send the code, the scammer can drain the balance in minutes and there is no chargeback or recall the way there is with a credit card or a bank transfer. The cards are also easy to buy anywhere and easy for the scammer to resell.
Why do these messages say the boss is in a meeting and cannot talk?
Because a live phone call would end the con instantly. The whole script is built to keep you off any channel where you could hear the real person’s voice. Being in a meeting, boarding a flight, or having a broken phone are all excuses to push you toward email or text, where the scammer controls both sides of the conversation.
How can the email show my boss’s real name if it is fake?
Anyone can type any name into the display name field of an email or set any name on a texting app. The name you see is not verified by anything. The real tell is the actual email address or phone number underneath, which is usually a free or unfamiliar account the scammer just created. Always check the address, not just the name.
What is business email compromise?
Business email compromise, or BEC, is a scam where a criminal impersonates an executive, employee, or vendor to trick a company into sending money or sensitive information. The CEO gift card request is one common version. The FBI tracks BEC as one of the most costly scams reported to its Internet Crime Complaint Center.
Who inside a company is most likely to be targeted?
New employees who do not yet know how leadership normally communicates, executive assistants whose job is to act fast on the boss’s behalf, and finance or accounts staff who move money routinely. Scammers often research a company first and aim the message at exactly the person most likely to act without questioning it.
How do I verify a gift card request safely?
Confirm it through a channel you already trust, never the one the message arrived on. Call the person on a number you already have saved, walk to their office, or message them on your company’s real internal system. Do not reply to the suspicious email or call any number the message provides, because that number reaches the scammer too.
I already bought the cards and sent the codes. What now?
Act fast. Contact the card issuer’s fraud line right away, since a balance that has not been drained can sometimes be frozen. Tell your employer and IT or security team immediately, then report the scam to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov. Keep your receipts and the original message as evidence.
Does falling for this mean I was careless?
No. These cons are run by organized operators who manufacture urgency, authority, and secrecy on purpose to short circuit normal judgment, and they aim at people who simply wanted to do their job well. The shame victims feel is part of how the scam survives. Reporting it, not staying quiet, is what protects the next person.
The short version
I got one of these texts once, from a boss I did not have, and for about four seconds it worked on me. Urgent, friendly, a little secretive, a small favor framed as trust. What saved me was not being clever, it was one flat rule: no real boss pays for anything with gift cards, ever. If a message from the top asks you to buy Apple, Google Play, or Amazon cards and send the codes right now and keep it quiet, it is a scam, every time. Do not reply. Call the person on a number you already trust, and let the request prove itself before your money leaves the building.