The Boss Needs Gift Cards by 3 PM. The Boss Is Not the Boss.

It’s the Monday before Thanksgiving. A new receptionist at a Center City insurance brokerage gets a text from the managing partner: “Stuck in a meeting. Need 10 gift cards for client appreciation, $100 each. Buy them now and send me the codes. Will reimburse today.” The partner is, in fact, at lunch with his family. The text came from a free number and a profile picture lifted from LinkedIn.

Gift card fraud is the oldest trick in the business email compromise playbook, and it spikes every holiday season for a simple reason: asking staff to buy gifts for clients is completely normal in November and December. The scammer isn’t inventing a strange request. They’re borrowing a real one. If you’re running a Philadelphia office with a client-gift tradition, this is the week to talk about it. Our post on holiday coverage gaps (https://www.abuzztech.com/your-office-closes-for-the-holidays-your-attackers-dont/) covers the other half of the season.

Why it works on smart people

Nobody falls for this because they’re careless. They fall for it because the message hits three buttons at once: authority (it’s the boss), urgency (needed by 3 PM), and secrecy (“don’t call, I’m in a meeting”). Newer employees, part-timers, and anyone who doesn’t have the owner’s cell number memorized are the easiest targets.

The tell is the channel. Real executives rarely ask for money-equivalent purchases by text from a number nobody recognizes. And gift card codes are the perfect payout for a criminal: once you read the numbers over, the money is gone in minutes, with no bank to call and no wire to recall.

What the scam looks like in 2026

The text or WhatsApp message from an unfamiliar number using the owner’s name and photo.
The spoofed email where the display name says “Mark Reynolds” but the address is a free Gmail account, or a look-alike domain with one letter swapped.
The hijacked real account, which is the nasty one. If an attacker has actually broken into a vendor’s or colleague’s mailbox, the request comes from a legitimate address with a legitimate signature.
The follow-up: after the first batch, a second request “because the client wants more.” Scammers go back to the well until someone stops them.

Four rules that kill this scam

No gift card purchases on a text or email request. Ever. Make it policy, in writing, with no exceptions for the owner. A rule with a VIP exception is a rule the scammer will impersonate.
Verify by a second channel you already trust. Call the person on the number saved in your phone, or walk down the hall. Never reply to the message or call a number inside it.
Route all client gifts through one person. If one office manager buys everything, any request that skips her is instantly suspicious.
Give new hires the rule on day one. The first-week employee with no baseline for how the boss communicates is the one most likely to be tested.

If someone already sent the codes

Move fast. Call the card issuer immediately, because unredeemed funds can sometimes be frozen. Keep the receipts and the original message. Report it at ic3.gov and to local police. Then ask the harder question: was the message spoofed, or is someone actually inside a mailbox? That’s an IT question, and the answer changes what you do next. Check for hidden forwarding rules and recent odd sign-ins, and reset credentials if there’s any doubt.

Make the rule stick

Send one short email this week, from the owner, that says: “I will never ask you to buy gift cards by text or email. If you ever get a message that looks like me asking, call me.” That 30-second note gives every employee permission to say no to the boss’s “voice,” which is the entire defense. Pair it with email filtering that flags external senders using internal display names, and most of these attempts never reach an inbox at all.