What should I do if my boss asks me to buy gift cards and send the codes?
Pause the request and contact your manager through a known route. Do not send card numbers, PINs, or photos to the requester. If you already shared them, contact the card issuer promptly and preserve the receipts.
If someone posing as your manager asks you to buy gift cards and send photos of the codes, you can still stop after the purchase. Buying a card and sharing its redemption details are separate events. Do not assume the value is already lost because you bought the card.
How the boss-impersonation request works
The US Federal Trade Commission described this boss-impersonation pattern in 2021. A criminal may spoof the manager’s address or use a compromised account, then invent an errand or office event and promise reimbursement. The FTC recommends checking with the manager at a known number, rather than using contact details from the message. FTC: boss gift-card impersonation
The request can work without a malicious attachment, a password request, or a fake login page. An employee can complete the requested actions without encountering any of those familiar warning signs.
Our invoice review asks whether a business owes a claimed charge. Here, an apparent manager is asking an employee to make a new purchase, possibly using personal funds. The intervention belongs before the purchase and again before the redemption details leave the employee’s control.
The photo can give away the balance
For the card scams described by the FTC, the card number and PIN let the recipient access the loaded funds even while the purchaser still holds the physical card. A photograph can reveal those details. You can still have the card in your hand after someone else has spent the balance. FTC: how gift-card scams work
A receipt documents a purchase. A card number or PIN can enable redemption. Treating every photo as harmless “proof of purchase” overlooks what the image actually contains.
The card is not the whole value
Illustrative sequence; outcomes are not automatic
- Request
An apparent manager asks for cards and promises repayment.
- Purchase
Buying loads value onto a card. Verify before spending money.
- Code disclosure
A photo can reveal the number and PIN. Stop before sharing them.
Possible consequence
- Redemption
Someone may use the details. Issuer records establish what happened.
Already shared? Contact the issuer; keep the card and receipt. Use no live cards or codes in training.
A real organization may have an approved employee-gifting program. That does not make an unexpected message asking for card codes a valid purchasing or distribution instruction. Confirm the request through the established manager and purchasing route, including the intended recipients and delivery method. A deadline or reimbursement promise supplies none of that verification.
If you bought the cards but have not shared the details
Keep the photos and codes to yourself while you verify the request through a known manager contact and the purchasing process.
Whether an unused purchase can be refunded depends on the issuer. Keep the card and receipt while you seek guidance. If the details have already been disclosed, move promptly to issuer support and internal reporting rather than waiting for evidence of redemption.
If someone already sent the codes
Contact the gift-card company immediately using its official support route. Keep the card and purchase receipt, report the scam, and ask whether the funds can be protected or refunded. The FTC provides issuer-specific contacts and recommends reporting to ReportFraud.ftc.gov. Recovery is possible in some cases, but not guaranteed. FTC: reporting and issuer contacts
Report the impersonation through your organization’s established channel too. Preserve the request and the time of disclosure. Avoid forwarding usable codes into a broad email thread; provide sensitive details only through the support or incident process that needs them. Managers should make prompt reporting easy even when an employee used personal funds.
Make sure staff can find a known contact route before an urgent request arrives. Our callback guide explains how to verify a request without relying on the number supplied in it.
