When your boss texts about an 'urgent favor': the gift card scam

A text comes in from an unknown number. The signature says it is your CEO. The message is short, casual, and urgent: "Are you at your desk? I need a quick favor."

You write back, because of course you do. The next text asks you to step out and buy a stack of gift cards — Apple, Google Play, sometimes Amazon. You will be reimbursed, the message promises. Just send the codes when you have them, and keep it quiet until tomorrow.

The whole thing is a scam. Your CEO never sent the first text.

How attackers find you

The setup is cheaper and faster than most people imagine. An attacker scrapes your company's "Team" page or LinkedIn, builds a quick list of employees and their managers, then pays a few dollars for a virtual phone number from any of a dozen consumer SMS services. Within an hour they can be blasting impersonation texts to a hundred people at once, each one signed with the right name at the bottom.

The first message is deliberately vague. "Are you available?" or "I have a quick task for you, are you at your desk?" The vagueness is the point — it elicits a reply, and a reply tells the attacker that the number is live and the person on the other end is willing to talk.

Why the script always lands on gift cards

Gift cards are the perfect vehicle for any scam that needs money out of a victim and into the wind. Once you read sixteen digits off the back of a card to someone, the value is gone. There is no reversal, no chargeback, no fraud department to plead with. The brand on the card does not care, and your bank cannot help — you bought a product, then you redeemed a product.

Wire transfers and ACH pulls are the other common ask, and the bigger versions of this scam still go that route. But wires create paper trails and can sometimes be clawed back. Gift-card codes cannot. A scammer who can convince one employee at a five-hundred-person company to walk to a drugstore and buy two thousand dollars in Apple cards has cleared their week.

The tells, in roughly the order you'll see them

A real executive does not text you about a "favor" from an unknown number. But pressure works on smart people, so it helps to be specific about what to look for:

• The "new number" line. "This is my personal cell, I'm out of the office today" is the script. Real executives do not announce a new number to a junior staffer over SMS.
• The artificial urgency. "I'm about to go into a board meeting, I can't take a call." This is not a coincidence. The scammer needs you to act before you verify.
• The shift from chitchat to errand. The first one or two messages are warm and content-free. The third names the task. That pivot is the scam.
• Anything involving gift cards or wires. No legitimate corporate workflow runs on Apple gift cards. None.
• A request to keep it quiet. "Don't mention this until I'm back." Confidentiality is the scammer's friend; it stops you from asking the obvious person.

If a single text changes who you trust on a number, slow down. Caller ID is a label, not a credential.

What to do when a message lands

When something that looks like it came from your boss arrives on a number you do not recognize, your job is to verify through a channel the attacker does not control. That means: walking to their desk, calling the number you already have saved, messaging them on your company's chat tool, asking a coworker who is sitting near them. Anything but replying to the text.

If you have already replied, that is fine — no harm done yet. The damage starts the moment you read a gift-card code aloud or send a wire. Stop the conversation, screenshot it for IT or HR, and report the number to your carrier and to the FTC at reportfraud.ftc.gov.

If your company has been hit before, push for a written rule that no executive will ever request gift cards over text. A single line in an onboarding deck stops a surprising number of these.

The pattern is older than SMS

Pretexting an authority figure to extract money from a subordinate is older than the telephone, and gift cards are just this decade's vehicle. The shape of the scam is what to remember: a name you trust, a number you do not, an errand that has to happen now and quietly. Any one of those is a yellow flag. All three at once is a stop sign.

If you are unsure about a number that just texted you, run it through a lookup before you reply. Carrier and origin information will not catch every scam — virtual numbers shed reputation easily — but they will surface the obvious ones, and the five seconds it costs you might save your company a few thousand dollars and save you a long Monday morning.