The Gift Card Scam

The Gift Card Scam is a classic in that it's been around forever with basically no changes in the text. Somehow it still works, though. You get an e-mail from someone in management that says they're surprising staff with gifts and need you to buy the gift cards because they're busy. Well that's nice of them! Once you've bought the gift cards they need you to take pictures of the front and back of the cards along with the receipt and send these to them.  Hmm, that's weird?

The Scam Email

Identifying Traits
  • Incorrect domain. These come from a random e-mail address that's not from your company's e-mail domain.  Gmail is often used for this.
  • Spoofed email. The scammer will use a company manager's name in the display field ("John Miller") but the e-mail comes from somewhere else. Always check the e-mail address, not just the display name.
  • Mobile phone signature. Most companies have branded signatures in their e-mails. The scammer tries to get around this by claiming to be sending from a mobile device.
  • Gift cards/Financial information. Whenever financial things are involved, always call the person at a known-good phone number to verify the request.
What It Does

This is a simple money grab, unfortunately. The scammer tries to convince you that your boss wants these gift cards sent to them. It's your boss, so you've got to do it right? Once you purchase the gift cards they'll want you to take pictures of all the critical numbers and send them to them. This is a bit weird because why would someone need pictures of the gift cards if they're going to give them out? If you send the pictures the scammer will be done with you, they'll cease contact, and you'll be left explaining an awkward situation with your boss. Unfortunately, while this scam is common, a lot of people still fall for it. Don't be in the hot seat and learn how to identify these. 

Something interesting with these scams is the scammers often research to learn who works in the company and the company organizational structure.  They want to target staff using manager names and not send to managers that'll notify us about it.  Where phishing (fishing) is a broad net, this is more similar to spear phishing.  This is an industry term for targeted scams or attacks.  They learn enough to appear somewhat legitimate.  This information is usually available on company websites, state government websites, and federal tax websites.

E-mail Conversation
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 11:44 AM
To: REDACTEDNAME
Subject: RESPONSE

HI REDACTEDNAME
I have been thinking of surprising some of the employees with gifts, I would need you to make a purchase on my behalf, your confidentiality would be appreciated. Email me once you get this.

REDACTEDNAME
Director, Projects
Sent from mobile device
====================================
From: John Miller
Sent: Monday, February 22, 2021 12:04
To: '[email protected]' <[email protected]>
Subject: RE: RESPONSE

Hey REDACTEDNAME! REDACTEDNAME is busy right now so she sent this over to me. What do you need me to do?
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 12:05
To: John Miller <[email protected]>
Subject: Re: RESPONSE

Great, I'm having a busy day and I hope I can trust you to keep this as a surprise. I want this to be between you and I, pending when they have received their gifts, Can you make the purchase on my behalf today? I am considering a variety of cards since they can be used anywhere and we can get that almost everywhere.
====================================
From: John Miller
Sent: Monday, February 22, 2021 12:07
To: 'REDACTEDNAME' <[email protected]>
Subject: RE: RESPONSE

Sure! What cards do you need me to get
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 12:11
To: John Miller <[email protected]>
Subject: Re: RESPONSE

Amazing, I need you to make a purchase of 6 Vanilla Visa gift cards and $500 face value each. You email me once you have the cards, How soon can you get it done? Also I will get your Reimbursement first thing tomorrow morning .

How soon can you get it done ?
====================================
From: John Miller
Sent: Monday, February 22, 2021 12:13
To: 'REDACTEDNAME' <[email protected]>
Subject: RE: RESPONSE

I should be able to do it after lunch. A couple hours
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 12:19
To: John Miller <[email protected]>
Subject: Re: RESPONSE

Alright, Email me once you get the purchase done.
====================================
From: John Miller
Sent: Monday, February 22, 2021 13:53
To: 'REDACTEDNAME' <[email protected]>
Subject: RE: RESPONSE

Got the cards. Want me to put them in your mailbox
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 14:02
To: John Miller <[email protected]>
Subject: Re: RESPONSE

Alright, I need you to take the card out of the packaging and send me a clear picture of the front and back of the cards alongside the receipt of purchase for reference propose.
====================================
From: John Miller
Sent: Monday, February 22, 2021 14:07
To: 'REDACTEDNAME' <[email protected]>
Subject: RE: RESPONSE

I dropped them off in your mailbox in the mail room. That okay? I put some gift wrap in with them.
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 14:11
To: John Miller <[email protected]>
Subject: Re: RESPONSE

That's not okay, This is what I need you to do, take the card out of the packaging and send me a clear picture of the front and back of the cards alongside the receipt of purchase accordingly for reference propose
====================================
From: John Miller
Sent: Monday, February 22, 2021 14:39
To: 'REDACTEDNAME' <[email protected]>
Subject: RE: RESPONSE

>>SENT FAKE PICTURE<<
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 14:58
To: John Miller <[email protected]>
Subject: Re: RESPONSE

You are to send me a clear picture of all the front and back of the cards alongside the receipt of purchase accordingly
====================================
From: REDACTEDNAME <[email protected]>
Sent: Monday, February 22, 2021 15:28
To: John Miller <[email protected]>
Subject: Re: RESPONSE

John, Are you there ?
====================================
From: Katy Mcneill <[email protected]> (DOESN'T WORK FOR CLIENT)
Sent: Tuesday, February 23, 2021 11:00
To: John Miller <[email protected]>
Subject: RESPONSE

Hello john

Do you get my message about the purchase on my behalf, REDACTEDNAME told me you have all cards. I need you to send me all cards now on my behalf okay

How soon can you do it.

REDACTEDACCOUNTANT
Controller
Sent from mobile device
in News