"Are You Available? I Need a Favor": The Gift Card Scam That Pretends to Be Your Boss

Even the world’s best boss doesn’t text employees asking for gift cards. Scammers do — and they use your boss’s real name to do it.

This scam hits small businesses, churches, schools and city offices across Kansas. It’s simple, it’s fast, and it works because employees want to be helpful.

How it works

1. The scammer looks up your organization’s website or social media to find the owner, pastor, principal or manager — and the people who work for them.
2. They send a short email or text using the boss’s name from a free email account or unknown number: “Are you available? I need a quick favor.”
3. Once you reply, they explain they’re in a meeting and can’t talk, and ask you to buy gift cards for clients, staff or a charity — and to keep it a surprise.
4. They ask you to scratch off the backs and send photos of the codes. The moment you do, the money is gone and almost impossible to recover.

The bigger cousin: fake payment and bank changes

The same trick is used for much larger amounts. A “vendor” emails that their bank account has changed and asks you to send the next payment to new account details. Or “the boss” asks for an urgent wire transfer. This is called business email compromise, and it costs businesses far more than gift card scams.

Red flags

• A request for gift cards — for any reason
• A familiar name with an unfamiliar email address or phone number
• “I can’t talk right now,” “keep this between us,” or “I need it in the next hour”
• Any request to change where payments go

A simple policy that stops it

Write it down, share it with everyone and stick to it:

• We never buy gift cards based on an email or text.
• Any change to payment or bank details is confirmed by phone using a number we already have — never one from the message.
• Anyone can stop and verify a request from the boss without getting in trouble. A good boss will thank you for checking.

Technical protections help too

Email filtering can flag messages from outside your organization and catch look-alike addresses, and two-factor authentication keeps scammers from sending messages from your real accounts. These are part of our managed cybersecurity for small businesses. Call us at 620-960-8711 to get your office set up.