What Are Gift Card Scams, and How Do They Actually Work?

Short answer: Gift card scams are urgent messages, often pretending to be the boss, asking someone to buy gift cards and read out the codes, which can be spent instantly and can't be recovered. Gift cards are for gifts, not payments, so anyone asking to be paid in them is a scammer.

This one is the simplest scam in the series to explain, because the entire thing hinges on a single fact: gift cards are for gifts, not payments. Anyone asking to be paid in gift cards — for any reason — is a scammer, without exception. That's not an oversimplification; it's the actual rule official consumer-protection guidance uses, because no real business, government agency, or employer has ever legitimately needed payment that way.

What's actually happening

The scam usually opens with urgency and a trusted identity: a text or email that appears to be from the business owner or a manager, sent while they're "in a meeting" or "can't talk right now," asking an employee to buy gift cards — often framed as client gifts, an office celebration, or something similarly plausible and time-sensitive. The same pattern shows up targeting people personally, impersonating the IRS, a utility company threatening shutoff, tech support (see the tech support scams post), or a "you've won a prize" claim — always urgent, always demanding gift cards specifically.

Gift cards are the payment method of choice for one simple reason: they work exactly like cash, except they can be transferred over the phone without meeting anyone. Once the recipient buys the cards and reads the codes off the back — usually by photographing them and sending the picture, or reading the numbers aloud on a call — the value on those cards is instantly available to whoever has the codes. There's no bank in the middle to flag or freeze anything, no chargeback, no reversal. It's simply gone the moment the code is sent.

A local business scenario

(A composite, illustrative pattern — not one specific business's story.)

A new employee at a small retail business gets a text that looks like it's from the owner: "Hey, it's [owner's name] — I'm stuck in a meeting and need a favor. Can you grab a few $100 gift cards for a client thing? I'll pay you back, just need it handled in the next 20 minutes." The tone matches how the owner actually texts, the urgency feels plausible for a busy small business, and the employee — new enough to want to be helpful, not yet familiar with how the owner usually handles things — doesn't want to seem difficult by asking questions.

They buy four $100 gift cards, photograph the codes, and send them by text as asked. The real owner, reached later that day about something unrelated, has no idea what the employee is talking about — the number that texted wasn't theirs at all. The $400 is already gone; the codes were redeemed within minutes of being sent.

Best practices

1. Treat any gift-card payment request as a scam, full stop. This is true regardless of who it appears to be from — a boss, a government agency, a vendor, tech support, anyone. No exceptions exist.
2. Verify unusual requests through a separate, already-known channel before acting — call the person directly on a number you already had, not one provided in the message. This is the same habit that stops invoice fraud: confirm before, not after.
3. Urgency and "don't tell anyone" are the actual red flags, not just the gift cards themselves — a request built to stop someone from pausing to double-check is doing that on purpose.
4. If you run a business with employees, say this out loud, once, clearly: "I will never ask you to buy gift cards for me, for any reason." One short sentence removes the entire premise the scam depends on.
5. If it already happened, act immediately and contact the gift card issuer — many have a fraud department that can sometimes freeze an unused balance if it's reported fast enough, though funds already spent generally cannot be recovered.

Helpful, free resources

• FTC: Avoiding and Reporting Gift Card Scams — the official U.S. government guide, including which company to contact to report a specific gift card used in a scam. Free.

A note on what this is and isn't: this post is general security education, not a personalized risk assessment of your specific business or systems. If you want a free, automated starting point for your own site, we offer a Security Health Check — free for any business, no obligation.