Protecting against gift card scams

How the scam usually unfolds

The typical gift card scam starts with a short message that appears to come from the owner, a manager or a director. It might say they are in a meeting and need a quick favour, then ask the employee to buy several gift cards for a client appreciation event or a staff reward. The employee is asked to scratch off the codes and send photos by email or text.

The message often comes from a personal email address or an unknown phone number, with an explanation such as a new phone or being away from the office. Criminals gather names and roles from your website, LinkedIn and social media, so the request can feel very personal and plausible. Some even start with casual small talk.

Why gift cards appeal to criminals

Gift cards are widely available, can be bought quickly at almost any store or online, and the value can be spent or resold within minutes once the codes are shared. Unlike a bank transfer, there is no account holder to trace and little chance of getting the money back. The Canadian Anti-Fraud Centre regularly warns that any request to pay with gift cards is a strong sign of fraud.

The same method shows up in other scams too, including fake government agencies demanding payment of fines or taxes, fake tech support calls and fake utility disconnection notices. No legitimate government agency or utility will ask you to pay with gift cards. The Canada Revenue Agency, police services and utilities do not accept payment in gift cards, so any such demand is a scam.

Set a clear policy

The best protection is a simple written rule that removes any doubt. Make it part of onboarding and repeat it in regular security reminders. When staff know the official process, a request that breaks it becomes obviously suspicious, and they feel supported in refusing or checking it. A sample policy might include the points below.

Leaders should state openly that they will never ask staff to buy gift cards by text or email, and that anyone who checks before acting is doing exactly the right thing. This removes the social pressure the scam relies on, because the employee no longer worries about disappointing a senior person.

• Gift card purchases require approval through the normal purchasing process
• No gift card codes are ever sent by email or text
• Any request from a new number or personal email is verified in person or by known phone number
• Report suspicious requests to IT or management immediately

Recognize the warning signs

Teach staff to watch for a combination of signals. The request is unusual for that person, comes through an unfamiliar channel, asks for secrecy or urgency, and involves gift cards or cryptocurrency. Any one of these alone deserves a pause. Together they almost always mean fraud. Share real examples so people recognize the pattern.

Encourage people to slow down and verify. A thirty-second call to the real person, using a number from the company directory, will expose the scam immediately. If the person is genuinely unreachable, the request can wait. Real business needs rarely depend on gift card codes being sent in the next ten minutes.

If someone has already sent codes

Contact the card issuer right away using the phone number on the back of the card or on the issuer's official website. Explain that the card was used in a scam and provide the receipt and card numbers. Sometimes unspent balances can be frozen. Keep all receipts, messages and phone numbers involved.

Report the incident to the Canadian Anti-Fraud Centre and your local police, and let your IT provider know, since the scam may indicate that an email account or contact list has been exposed. Treat the employee with understanding. These scams are designed by professionals, and a supportive response encourages faster reporting next time.