“The boss texted me to buy gift cards.” Is it real?
2026-11-07 · Chris Coulson
A holiday gift-card scam guide for York, Lancaster and Harrisburg offices.
By Chris Coulson, Coulson Technologies · York, PA
Chris Coulson has 40+ years of IT experience and runs Coulson Technologies in York, PA.
A message that looks like your boss is not permission to buy gift cards. Stop, call the person on a number you already have, and confirm the request before spending anything.
November and December bring client gifts, staff thank-yous and busy calendars. That makes a rushed favor sound believable. Whether you run a York office, answer phones in Lancaster or just started a job in Harrisburg, you deserve a clear rule—not a guessing game about what the owner might want.
How does the fake-boss gift-card request work?
A scammer pretends to be someone with authority and asks an employee to buy gift cards, then send the numbers or redemption codes. The request can arrive by text, WhatsApp or email, and may start with an innocent-looking “Are you available?”
The next message supplies the reason: client appreciation, staff gifts or a surprise. Then comes pressure: “I need them now,” “Don’t call, I’m in a meeting,” or “Send me the codes.” Keeping it secret prevents a helpful coworker from questioning the purchase.
The FBI’s gift-card fraud advisory describes criminals impersonating management through email, calls and texts. A familiar name does not prove who is writing. An email address can resemble the real one, and a criminal may even have access to a genuine company mailbox.
The goal is the code, not the plastic. Someone with the redemption details may spend the balance while the employee still holds the card. Treat a photo of the back just as carefully as the card itself.
Fictional example for training—not a real employee, message or client incident.
A real reminder from our work
One of our clients asked his Amazon smart device to call customer service and reached a scammer instead. He was sent to Walgreens for Google Play gift cards while the scammer ran up about $15,000 in Amazon orders. His bank caught it.
This was a customer-service scam, not a fake-boss request. The shared warning is the demand for gift cards.
Is this text from my boss real?
You cannot confirm that from the name, photo or message alone. Call your boss using a saved number or your trusted staff directory—not the number supplied in the suspicious message.
If you are searching “boss asked me to buy gift cards text,” leave the message unanswered while you check. Ask directly: “Did you ask me to buy gift cards and send the codes?” Walking over to the person is another option when you are in the same office.
Warning signs include:
- A new number explained away as “my temporary phone.”
- A request to use your own money with a promise of reimbursement.
- Instructions to keep the gifts secret or avoid calling.
- A request for photos, card numbers or PINs rather than the gifts themselves.
- Another purchase request immediately after the first.
A fake CEO gift card email can use polished wording. Do not wait for a spelling mistake. If the person cannot be reached, the purchase waits.
What office rule stops this gift-card scam?
Use this rule: We never buy gift cards or send codes because of a message. We call the person on a number we already have and follow our normal approval process. The owner is not an exception.
That does not ban legitimate holiday gifts. It separates a gift plan your office has approved from a stranger’s urgent instructions. Choose who handles gift purchases and tell everyone how approval works before the shopping starts.
For an owner worried about a gift card scam, small business protection starts with giving staff permission to pause. Say plainly: “You will not get in trouble for checking a request that appears to come from me.” Include receptionists, part-time staff and new hires—not just the people who usually make purchases.
Rehearse one response: “I need to verify this through our usual process.” A real manager can wait for that check. A scammer wants to prevent it.
What email can an owner send staff this week?
Send a short note that makes the rule explicit and gives people permission to call. Copy this into your normal staff email, review it, and sign it as you usually would.
Subject: Our holiday gift-card rule
Team, I will never ask you to buy gift cards or send their codes because of a text, WhatsApp message or email. If a request looks like it came from me, stop and call me using the number you already have. If I cannot answer, wait. Follow our normal purchase approval process. You will never get in trouble for checking. Already bought cards or shared codes? Tell me immediately so we can act. Thank you for protecting each other.
This is a quick read, not a long training assignment. Discuss it briefly so employees know which trusted number to use and whom to contact if the owner is unavailable.
What should we do in the first hour if codes were sent?
Contact the gift-card issuer immediately, then your bank or payment-card provider, then report the scam at IC3.gov. Act now even if you feel embarrassed; recovery is not guaranteed, but delay can reduce the chance of stopping remaining funds.
Use this first-hour checklist as an order of action, not a reason to wait for an hour to pass:
- Call the gift-card issuer. Use the number on the card or its official website. Explain that the codes were sent to a scammer. Ask whether any remaining balance can be frozen and whether a refund is possible. Keep the cards and receipts.
- Call the bank or payment-card provider used for the purchase. Explain exactly what happened, including that an employee may have made the purchase under false instructions. Ask what protections or recovery options apply. Do not assume a purchase you authorized qualifies as an unauthorized charge.
- File a report at IC3.gov. Include the messages, sender details, purchase amounts, dates and available transaction records. Save the report confirmation. You can also report at the FTC’s ReportFraud site and contact local police.
- Tell the owner and IT support. Stop further purchases. Preserve the original messages, emails and receipts rather than deleting them. Let IT advise on securely collecting the evidence and checking any involved account.
The Office of the Comptroller of the Currency recommends contacting issuers, financial institutions and reporting agencies. The FBI also notes that prompt contact with the gift-card business has helped some victims recover funds. Neither is a promise that your money will come back.
What if the request came from a real company email account?
A genuine address does not make a gift-card request safe. Ask IT to check whether someone has taken over the mailbox, including unexpected sign-ins and hidden rules that forward or move messages.
Coulson Technologies can help review the account and the email safeguards around it through our cybersecurity services. The next steps depend on what the review finds; a suspicious message alone does not prove a takeover.
Holiday gift card phishing is not a test of whether your staff are smart. It is pressure applied to people trying to help. For offices preparing holiday gifts or nonprofit activities around GivingTuesday on December 1, 2026, put the verification rule in place before the rush.
Need help checking an email that feels wrong? Contact Coulson Technologies through the website’s “Get in Touch” form. We are based in York, PA, serving businesses across South Central Pennsylvania.
If you don’t know, don’t click. And when a message asks for gift-card codes, stop and call.
What else should staff know about fake-boss gift-card requests?
The same verification rule applies regardless of the messaging app or the apparent sender. These quick answers cover common questions.
Should I reply to ask whether it is really my boss?
No. A reply goes back to whoever sent the message. Call your boss on a number you already have instead.
What if my boss really does buy gift cards for staff?
Legitimate gifts still need your normal purchase approval process. Verify independently before buying cards or sharing redemption details.
Can the gift-card company return the money?
Sometimes remaining funds can be stopped, but recovery is not guaranteed. Contact the issuer immediately and keep the cards and receipts.
Should I report it if no money was lost?
Yes. Tell your owner or IT support, and you can report the attempted scam to IC3. The FBI asks for complaints regardless of dollar loss.
Does a real company email address prove the request is safe?
No. An attacker may have access to the real mailbox. Verify the request by calling a known number and ask IT to check the account.
Which sources support this guide?
The guidance above prioritizes federal sources and an official date confirmation. These links support the scam pattern, verification rule and reporting steps.