Recognise and prevent CEO gift card email scams.
Resources / CEO just emailed you asking for gift cards: here's why it's a scam
If an email from your CEO asks you to buy gift cards, it is almost certainly a scam, not your boss. This is a form of business email compromise: the sender impersonates a senior person, leans on urgency and secrecy, and asks you to buy cards and send through the codes. The rule is simple. No genuine executive buys gift cards over email. Verify the request by voice, on a number you already know, before you do anything.
Call the person on a known number, do not reply
Untraceable and final once the codes are sent
ReportCyber and Scamwatch, then your bank
The email looks like it is from your CEO, manager, or a director. It often starts casually, "Are you at your desk?", to get a reply before the ask. Then comes the request: buy several gift cards, Apple, Google Play, Steam, or a retailer, and send back photos of the codes on the back. It is framed as urgent and confidential: a surprise for a client or staff, done quietly before a meeting ends. Once you send the codes, the money is gone and is very hard to recover.
Gift cards are as good as cash and nearly impossible to trace, which is exactly why scammers ask for them and never a bank transfer they might have to reverse. Impersonating a senior person adds pressure: staff are more likely to act quickly, and less likely to question, a request that appears to come from the top. The scam runs on authority plus urgency, not on any clever technology.
The reply-to address does not match your organisation's real domain, or the display name is right but the address is a free webmail account. The message pushes urgency and secrecy and steers you away from a phone call. It asks for gift cards, or for the request to be kept between the two of you. Real internal requests survive a five second check: a quick call or a message on a channel you already use.
Do not reply, and do not buy anything. Verify by contacting the person directly on a number or chat you already have, never the details in the email. Report the message to whoever runs your IT, and use your email tool's report phishing button so the sender can be blocked. If your business has an incident process, follow it, and let colleagues know the impersonation is doing the rounds.
Act fast, the first hour matters most. Contact the gift card issuer straight away and ask them to freeze the cards, some can act if the balance has not been drained. Tell your bank or card provider. Report it to ReportCyber at cyber.gov.au and to Scamwatch. Keep the email and receipts as evidence. Then tell your team, because the same scammer usually tries several people in one business.
Most of this is process, not expensive tooling. Set a standing rule that any payment or gift card request is verified by voice, no exceptions. Turn on email authentication (SPF, DKIM, and DMARC) so lookalike senders are easier to catch, and flag external emails with a banner. Run short, regular phishing awareness for staff. These sit alongside the Australian Signals Directorate's Essential Eight, a practical baseline of controls worth working through as a small business.
I clicked a phishing link, what now?: The steps to take in the first few minutes.
Email security checker: Test whether your domain has SPF, DKIM, and DMARC set up.
Essential Eight for small business: A plain-English guide to the baseline controls.
Managed IT support: One accountable partner for your email security and day-to-day IT.
No. Genuine executives do not buy gift cards over email and ask staff to send the codes. Treat any such request as an impersonation scam and verify by voice first.
Gift cards are as good as cash and nearly impossible to trace or reverse. Once you send the codes, the funds are gone, which is exactly why scammers prefer them to a bank transfer.
Report the scam to ReportCyber at cyber.gov.au and to Scamwatch. Tell your IT contact and your bank, and use your email tool's report phishing button so the sender can be blocked.
The Essential Eight is a baseline of eight practical security controls from the Australian Signals Directorate. It is a sensible starting point for a small business hardening its defences.
Tell us your team size and current setup. We will map what fits, honestly, with a fixed quote in one business day. Free 30-minute discovery call, no obligation.
Prefer to talk? Call (02) 9053 8789.
Belivanis Information Systems