Your Boss Doesn’t Need Five Apple Gift Cards by Noon

It Starts With ‘Are You Available?’

Your bookkeeper gets an email at 9:12 on a Tuesday. It’s from you. Or it looks like it is. Your name is right there in the From line.

‘Hey, are you at your desk? Need a quick favor. I’m stuck in a meeting and can’t talk.’

Of course they write back. You’re the boss. Then the next message comes in. You want to surprise a few clients with gift cards, you need five $200 Apple cards, and you need them before noon. Scratch off the backs, snap photos, send them over. You’ll pay them back tonight.

By lunch, $1,000 is gone. There’s no bank to call and no chargeback. Just a very bad afternoon and an employee who feels terrible about something that wasn’t really their fault.

This is one of the oldest scams aimed at small businesses, and it still works. It picks up every year right about now, when buying gifts for clients and staff is a normal thing to do.

Why Scammers Love Gift Cards

Gift cards are basically cash you can send in a photo. Once the scammer has the card number and PIN, they can drain it or resell it within minutes. There’s no account in their name and no wire transfer for a bank to freeze. The FTC has warned for years that anyone demanding payment in gift cards is a scammer. Real businesses and real government agencies don’t work that way.

It also takes zero hacking skill. Nobody broke into your email. They made a free Gmail account with your name on it, looked up who works for you on LinkedIn or your website’s About page, and sent a message. That’s the whole operation.

How It Usually Plays Out

The details change but the pattern doesn’t. Watch for these:

A display name that matches, an address that doesn’t. The email says it’s from you, but the actual address is something like [email protected]. On a phone, most mail apps only show the name.
The warm-up. ‘Are you available?’ or ‘Got a minute?’ They want you engaged before they ask for anything.
A reason they can’t call. In a meeting, at a funeral, on a flight, at the doctor. Anything to keep you from picking up the phone.
Urgency plus secrecy. ‘Need these by noon.’ ‘Keep this between us, it’s a surprise.’
Photos of the back of the card. This is the giveaway. Nobody who actually wants to give a client a gift card needs a picture of the scratched-off PIN.

Lately it’s moved to text too. A message from an unknown number says ‘Hey it’s [your name], this is my new number, save it.’ Same script, different app.

Why Smart People Fall for It

I want to be clear about this. The people who get hit aren’t dumb. They’re helpful. They’re the employee who always says yes and gets things done without a ton of questions. That’s exactly who you want working for you, and exactly who the scammer is counting on.

Your team also doesn’t want to bug you. If the boss says ‘I’m in a meeting, can’t talk,’ calling anyway feels like overstepping. The scam works because it uses normal office manners against you.

So the fix isn’t ‘tell everyone to be more careful.’ The fix is giving them permission, in writing, to stop and check.

The One Rule That Kills This Scam

Write this down and send it to your whole team today:

We will never ask anyone to buy gift cards by email or text. Ever. If you get a request like that, even if it looks like it came from me, call me on the number you already have for me before you do anything.

That’s it. Once your team knows you will never ask this way, the scam has nothing to stand on. Make it clear that calling you to double-check will never get anyone in trouble. You’d much rather take an annoying call in the middle of a meeting than lose a grand.

A few more things that help:

Turn on external sender warnings. Microsoft 365 can tag any email that came from outside your organization, and Google Workspace has its own warning banners for suspicious senders. A big ‘External’ label on an email that claims to be from the owner is hard to ignore.
Make callbacks a habit for anything involving money. Gift cards, wire transfers, changes to payment info. Verify by phone using a number you already had. Never the number in the message.
Tell the new people. New hires are a favorite target because they don’t know how you write yet and they want to make a good impression. Put the gift card rule in your onboarding.
Talk about it out loud. Forward the next one you get to the team with a note: ‘This is the scam. This is what it looks like.’ Real examples stick better than any training video.

If Someone Already Bought the Cards

Move fast. Speed is the only thing that gives you a shot at getting anything back.

Call the gift card company right away using the number on the back of the card or on their official website. Tell them the card was used in a scam. Sometimes they can freeze a balance that hasn’t been spent yet.
Keep the receipts and the physical cards. You’ll need them.
Report it to the FTC at ReportFraud.ftc.gov and to the FBI at ic3.gov.
Check whether the scammer got anything else. If they had a real back-and-forth going with your employee, they may have asked for logins or other info too.

And please don’t fire the person who fell for it. Hold a five-minute team meeting, explain what happened, and roll out the rule above. Now everyone in the office knows the scam on sight, including the one person who will never fall for it again.

What This Means for You

You don’t need new software to stop this one. You need one clear sentence from the owner and a team that feels safe picking up the phone. Send that message today, before the holiday rush hands scammers the perfect cover story.

If you want help turning on external sender warnings in Microsoft 365 or Google Workspace, or you just want someone to look at a suspicious email, reach out. Always happy to troubleshoot.