Holiday gift card scams work by impersonating your boss or a trusted vendor in an email, then asking someone in your office to buy gift cards or redirect a payment before anyone stops to question it. The scam relies on speed and year-end chaos, not sophisticated hacking. Boston businesses see a real jump in these attempts between Thanksgiving and New Year’s, and the fix is mostly about slowing people down, not buying new software.
- Gift card and payment-diversion scams rise sharply from late November through year-end as staff rush to close out vendor accounts and holiday errands.
- The scam almost always starts with a spoofed or compromised email that looks like it came from an executive or a known supplier.
- A simple rule, no gift card purchases or payment changes without a phone call to a known number, stops most of these cold.
- Microsoft 365 has built-in tools, like external sender tags and mail flow rules, that catch many of these messages before a human ever sees them.
- Reporting fast actually works. Businesses that contact their bank and the FBI’s Internet Crime Complaint Center within hours have recovered funds that looked gone for good.
Why do these scams spike around the holidays?
Offices are short-staffed with people out for vacation, finance teams are rushing to close out year-end invoices, and everyone’s inbox is already full of real shipping notices and holiday messages. A fake request to “grab some Amazon gift cards for the team” or “update our remittance account before the holidays” blends right in. The broader fraud numbers back up how common this has become: the Federal Trade Commission told Congress that consumers and businesses reported $15.9 billion in fraud losses in 2025, up from more than $12 billion the year before, with imposter scams, the exact category these holiday emails fall into, drawing over $3.5 billion in reported losses and more complaints than any other fraud type.
How does a gift card or payment-diversion scam actually unfold?
It usually starts with one of two emails. The first looks like it’s from your CEO or office manager, often sent from a lookalike domain, asking an employee to quietly buy gift cards for “client gifts” and send the redemption codes by reply. The second looks like it’s from a vendor you’ve paid for years, saying their bank changed and here’s the new routing number for this month’s invoice. Both depend on the person receiving it acting fast without checking. Once a gift card code is sent or a wire goes out, the money is gone in minutes.
What should your staff actually watch for?
Train people to notice the pattern, not just the content. A request for secrecy or urgency, “don’t mention this to anyone, I’m in a meeting,” is a red flag on its own. So is any request to buy gift cards for business purposes at all, since legitimate vendors and bosses almost never ask for that. Payment or banking changes sent only by email should be verified by phone, using a number already on file, not one in the email. Front-desk and accounts payable staff are the usual targets.
What can Microsoft 365 do to help catch these before they land?
If your business runs on Microsoft 365, you likely already have tools that help, they just need to be configured. External sender warning tags flag any message coming from outside your organization, which makes a spoofed “CEO” email look suspicious right away. Mail flow rules can catch phrases like “gift card” or “wire transfer” paired with urgency language and route those messages for review. Multi-factor authentication limits the damage if an account is actually compromised rather than just spoofed. A lot of small businesses already have these features and haven’t turned them on. We covered the mechanics of account takeover in our piece on business email compromise, and the holiday season is when those same techniques get dressed up in gift wrap.
What should you do if a scam attempt gets through?
If someone already sent gift card codes or wired money before catching on, speed matters more than anything else. Call your bank immediately and ask about a recall or reversal. File a detailed report at the FBI’s Internet Crime Complaint Center, including every banking detail you have, since its recovery asset team has intercepted and returned funds in cases reported quickly. Waiting a few days to see if it sorts itself out is the biggest reason recovery fails.
Frequently asked questions
Is a gift card request from my boss ever legitimate?
Almost never for business purposes. If an email asks you to buy gift cards and send the codes, call the person directly using a number you already have, not one from the email, before doing anything.
How is this different from regular phishing?
Gift card and payment-diversion scams target a specific action, buying cards or changing banking details, rather than trying to steal a password through a fake login page. That makes them harder for spam filters to catch on content alone, which is why staff training matters as much as technical tools.
Does cyber insurance cover these losses?
It depends on your policy and whether you can show you followed basic verification procedures. Many insurers now ask specifically about payment verification policies before binding coverage, so having a documented process helps both prevention and any claim afterward.
We’re a small office. Do we really need to worry about this?
Small businesses are frequent targets precisely because they often lack a formal verification policy. A five-minute phone call policy for payment or gift card requests costs nothing and blocks most of these attempts.
One quick, unverified email costs a business real money, and it happens to companies with firewalls and antivirus already in place because the weak point is a process, not a piece of software. If your team hasn’t talked through a payment-verification policy or checked whether your Microsoft 365 external sender warnings are turned on, now is the moment, not after the first incident. Boston Managed IT offers a free 15-minute Microsoft 365 or security review to check exactly this. Call (617) 322-5155 or visit bostonmit.com/contact to get on the calendar before the holiday rush.
— Boston Managed IT
