Treat any emailed request from the owner for gift cards, an urgent payment or new bank details as unconfirmed until someone phones the owner on a known number, and tell staff in advance that checking is expected.

A favour, from the owner

The email arrives mid-afternoon under the owner's name. Are you at your desk? I need a quick favour.

The next message asks for gift cards, six of them at a hundred dollars each, for clients or staff. Scratch the backs, photograph the codes, email the pictures.

I am in meetings all day and cannot take calls, it says, and I will pay you back tonight. The person reading it wants to help, and in December, with gifts being bought everywhere, the request sounds plausible.

The owner sent nothing. This is a well-worn fraud aimed at small businesses, and the holidays suit it.

How the request is built

The third does the real work. It closes off the one check that would expose the scam, a quick call to the owner, before the employee thinks of making it.

Why gift cards

Once the codes on the back of a card are photographed and sent, the balance can be spent online or sold on within minutes, from anywhere.

There is no card payment to dispute and no transfer to trace, and the store that sold the cards did nothing wrong.

The same approach is used for larger sums: an urgent payment to a new supplier, or a note that a regular supplier's bank details have changed. Those cost more, and they are stopped the same way.

Where the details come from

The fraud needs a name, an email format and a reason the owner is out of reach. Many businesses publish all three without meaning to.

The team page names the owner and the office manager. Any email address shows the format. And an automatic reply saying the owner is away until January 3 tells whoever writes exactly when to try, and whom to write to.

Keep automatic replies short: messages are being answered by the office, with a phone number. Travel dates help nobody but a fraudster.

The address that looks right

The sender's name shows the owner's name, and on a phone that is often all anyone sees. The address behind it is usually a free webmail account, or a domain one letter away from yours.

Some messages forge your own domain. SPF and DKIM records let receiving servers check that mail claiming to come from your domain really does, and a DMARC record tells them to reject what fails.

Ask whoever manages your email whether those records are in place. None of them catches every message, which is why the real defence is a rule rather than a filter.

A worked example

A family-run RV park beside a river, a few minutes off a highway, closes most of its sites from November to March.

The owners spend part of each winter away, and the office manager runs things alone: next season's bookings, a few monthly guests and the bills.

Last January an email under the owner's name asked her to buy gift cards as thank-you gifts for some long-time guests, and to keep it a surprise. She bought four and emailed photographs of the codes.

When a second message asked for six more, the amount felt wrong and she phoned the owner's mobile. He had sent nothing. The first four cards had already been spent.

The fraudster had used only public sources: the owners' names from the website, her name from the contact page, and their dates away from the owner's automatic reply.

The park now has a written rule that gift cards, payments and changed bank details are never arranged by email alone, and that the office manager phones to check, whatever the time difference. The automatic reply no longer mentions travel.

The rule that stops it

Write it down: requests for gift cards, payments to new accounts and changes to anyone's bank details are confirmed by phone before anything is done.

The call goes to a number already known, from the staff list or the phone's contacts, never one supplied in the email.

For payments above an amount you choose, a second person approves. The fraud relies on one helpful person acting alone and quickly.

Telling staff it is fine to check

The rule works only if staff believe they will not be scolded for using it. Many hesitate to interrupt a busy owner over what looks like a small errand.

So the owner should say it in person, before the holidays: I will never ask for gift cards by email, and if a message says I did, call me, even in a meeting.

Repeat it to seasonal staff and new hires on their first day, and thank anyone who checks, even when the request turns out to be real.

If the codes have been sent

Call the company that issued the cards straight away, using the number on the card or the store's own. If the balance has not been spent, it can sometimes be frozen.

Keep the emails, report the fraud to the police, and warn the rest of the staff, because the same sender often tries again.

If the message came from the owner's real address rather than a lookalike, the mailbox itself has been broken into. Change its password at once, and check for forwarding rules someone else may have added.

The counter-case

A business run by one person has nobody to send the request to, though fake supplier invoices and changed bank details still reach it.

A small team that works side by side every day can simply ask across the room. The rule still matters for the days someone is away, which are exactly the days the email arrives.

For everyone else, confirm by phone, and make sure staff know they are expected to.

Before the holidays

  1. Tell staff you never ask for gift cards by email.
  2. Confirm every payment request by phone.
  3. Use a known number, never one from the email.
  4. Require two people for bank detail changes.
  5. Remove travel dates from automatic replies.
  6. Ask about SPF, DKIM and DMARC for your domain.
  7. Brief seasonal staff on their first day.

Step one is the one that makes the rest work. A rule staff are afraid to use protects nobody, and a single sentence from the owner removes the fear.

Card details arriving in the same inbox from customers are covered in customers who send card numbers by email.

Frequently asked questions

How does the boss gift card scam work?

An email under the owner's name asks a staff member to buy gift cards urgently and send photographs of the codes, with a reason the owner cannot take a call.

Why do scammers ask for gift cards?

Because once the codes are sent, the balance can be spent or sold within minutes from anywhere, with no payment to dispute and nothing to trace.

Where do scammers get the details?

Mostly from the business itself: names on the team page, the email format from any address, and travel dates from automatic replies saying the owner is away.

What rule stops this fraud?

Gift cards, payments to new accounts and changed bank details are always confirmed by phone, on a number already known, before anything is done.

Will SPF and DKIM stop these emails?

They help receiving servers reject mail forging your own domain, but not webmail accounts or lookalike domains. That is why a phone check is still needed.

What if the codes were already sent?

Call the card issuer at once, since unspent balances can sometimes be frozen. Keep the emails, report it to the police and warn the rest of the staff.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Staff who would never question the boss?

Tell us how your office handles payments. We will check your email records and help you word a rule staff can follow.

Start a Conversation