Fake boss texts, bogus delivery alerts, and gift card requests spike every holiday season. Learn how these scams work and the simple rules that stop them.
Every November and December, small businesses see a surge in scams built around the holidays. Staff are busy, gift buying is normal, packages are arriving every day, and year-end bonuses and client gifts are on everyone's mind. Criminals know this, and the payment they ask for most often is the gift card. The FTC has said plainly that anyone who demands payment by gift card is a scammer, yet gift cards remain one of the most commonly reported payment methods in fraud complaints because they are easy to buy, easy to pass along, and very hard to trace or reverse. Offices in Albuquerque, Rio Rancho, and Santa Fe are targeted just as often as larger companies, because smaller teams usually have fewer approval steps.
The Boss Gift Card Scam
The most common holiday scam aimed at businesses starts with a short text or email that appears to come from the owner or a manager: "Are you at your desk? I need a quick favor." The sender is supposedly stuck in a meeting and wants to surprise clients or staff with gift cards, and asks the employee to buy several cards, scratch off the backs, and send photos of the codes. The message often promises reimbursement and stresses that it must stay a surprise.
These messages usually come from a personal Gmail or a random phone number, with the display name set to the real owner. Attackers pull names and titles from your website, LinkedIn, and Google Business Profile, so the details look right. It is a form of the executive impersonation described in our guide to business email compromise, just with gift cards instead of a wire transfer. Once the codes are sent, the balance is typically drained within minutes.
Other Holiday Scams That Hit Businesses
Fake delivery notices. Texts and emails claiming a package could not be delivered, with a link to "reschedule" or pay a small redelivery fee, are everywhere during the holidays. The link leads to a page that steals card numbers or login details. Always check delivery status by typing the carrier's website into your browser or using its official app, never through a link in a message.
Fake invoices and order confirmations. Emails that look like purchase confirmations, renewal notices, or invoices for things nobody ordered try to get someone to call a fake support number or open an attachment. The phone call often ends with a request for remote access to a computer or a "refund" paid in gift cards.
Shopping account takeovers. Business purchasing accounts with saved payment cards are valuable to criminals. Reused passwords are the usual way in, so use a password manager with unique passwords and turn on multi-factor authentication or passkeys for every account that can spend money.
Fake stores and charity appeals. Lookalike shopping sites advertising deep discounts on electronics or office supplies, and fake charity drives that use real disaster or holiday themes, both spike at year end. Buy from retailers you know, and give to charities through their official websites.
If You Sell Gift Cards
Retail shops, restaurants, and salons that sell their own or third-party gift cards face a different set of tricks. Criminals tamper with cards on display racks, recording the numbers and waiting for a real customer to load money onto them. Others call the store pretending to be from corporate or a payment processor and ask a cashier to read card numbers over the phone or activate cards for a "test." Train front counter staff to check packaging for signs of tampering, never read card numbers to callers, and escalate large or unusual gift card purchases, especially bulk orders paid with cards that do not match the buyer.
Simple Rules That Stop Most of These Scams
Write down a clear policy that your business never asks employees to buy gift cards, send card codes, or make purchases by text or personal email. Share it with every employee before Thanksgiving. When people know the rule ahead of time, a request that breaks it is easy to recognize as fake.
Verify unusual requests on a second channel. If a request involves money, gift cards, payment details, or passwords, call the person on a number you already have, or walk over and ask. Make it clear that nobody will get in trouble for slowing down to check.
Route purchases through normal channels. Client and staff gifts should go through a company card or purchasing process with an approver, not through an employee's personal money. This removes the most convincing part of the scam, the promise of reimbursement.
Turn on email protections. External sender warning banners, display name impersonation alerts, and a one-click phishing report button help staff spot fake messages from the boss. Our article on email security and phishing prevention explains these settings for Microsoft 365 and Google Workspace.
Run a short pre-holiday refresher. A fifteen-minute team huddle with two or three real examples does more than a long annual course. Show a fake boss text, a fake delivery alert, and a fake invoice, and practice what to do. Our guide to cybersecurity training for staff has ideas for keeping these sessions short and useful.
What to Do If Someone Already Sent Gift Card Codes
Move quickly. Contact the company that issued the gift card right away, using the phone number on the back of the card or on its official website, and tell them the card was used in a scam. Keep the physical cards and the receipts, since the issuer may ask for them, and some issuers can freeze remaining funds if the report comes in before the balance is spent. Then report the scam at ReportFraud.ftc.gov, and file a complaint at ic3.gov if the scam came through email, text, or a website.
If the scammer may have gotten into an email or shopping account, change the password, sign out of all sessions, and check for new inbox rules or saved payment methods. If you are unsure whether a loss is covered by insurance or how to handle it on your books, talk with your insurance agent and your accountant.
Frequently Asked Questions
Why do scammers ask for gift cards?
Gift cards work almost like cash. Once a scammer has the card number and PIN, they can spend or resell the balance within minutes, and the transaction is very hard to trace or reverse. That is why legitimate businesses and government agencies do not ask for payment in gift cards.
Would my boss really text me to buy gift cards?
It is very unlikely. Treat any text or email asking you to buy gift cards and send the codes as a scam until you confirm it in person or by calling a number you already have. A real manager will not mind the check.
Can I get my money back after a gift card scam?
Sometimes, if you act fast. Contact the gift card issuer immediately with the card and receipt, and report the scam to the FTC. Recovery is not guaranteed and becomes much less likely once the balance has been spent.
How can I tell if a delivery text is fake?
Fake delivery texts usually include a link and ask you to confirm details or pay a small fee. Do not tap the link. Look up the tracking number on the carrier's official website or app instead, and delete the message if nothing is pending.
HelpTek helps Albuquerque and Santa Fe businesses set up email protections, multi-factor authentication, and short staff training sessions as part of our cybersecurity services. Our regular hours are Monday to Friday, 8 AM to 4 PM, with 24/7 emergency response when a scam turns into an account compromise. Contact us to get your team ready before the holiday rush.
