Your Boss Emailed You to Buy Gift Cards: What Should You Do?

If your boss emails you to buy gift cards urgently, pause the purchase and contact them through a phone number or other channel you already trust. Do not verify the request by replying to the same message, and do not send gift-card numbers, PINs or photos of the codes. A familiar name and a plausible company event are not enough to authorize a purchase.

Why this particular request deserves a pause

The request often sounds small and personal: an executive needs a quick favor, is unavailable for a call and wants gift cards for staff or clients. You may be told to buy them now and claim the money back later. The pressure is to act before checking.

In its January 2026 warning about boss impersonation, the US Federal Trade Commission describes unexpected emails, texts and calls asking employees to buy gift cards and send the numbers. It specifically advises checking with the boss using contact details known to be real, rather than responding through the channel that delivered the request.

Gift cards can be legitimate gifts. That does not make an unexpected instruction to purchase them and disclose their redemption codes a legitimate work task. The FTC explains that the numbers and PIN let a scammer take the money without having the physical card.

How to verify a gift-card email from your boss

1. Stop before spending or sharing anything

Do not buy cards, use a personal payment card or send codes while verification is pending. If you already bought the cards, keep them and the receipts. Do not send a photograph of the back to prove you completed the task: that photograph may reveal everything needed to redeem them.

2. Start a separate conversation

Call your manager using a saved number or your established company directory. If you work together in person, ask directly. Do not use a new number supplied in the email or let the sender redirect the check to another contact they provide. A second reply in the same thread does not independently establish who is asking.

You can keep the wording simple: “I received a request in your name to buy gift cards. Before I do anything, did you request this, and has it been approved through our normal process?” If the person cannot be reached through a trusted route, leave the purchase on hold.

3. Keep the normal approval process

Even if your manager confirms a genuine gift purchase, use your organization's usual purchasing and expense rules. Confirm the purpose, budget and authorized way to deliver the gifts. Do not let seniority, urgency or a request for secrecy replace approval. An employee should not have to choose between following a payment control and appearing helpful.

4. Report the impersonation internally

If the real manager denies the request, notify your IT or security contact through your normal reporting route. Preserve the original message so they can investigate and warn colleagues. Do not circulate usable gift-card codes in a group chat or forward them widely as part of the warning.

What if you already sent the gift-card codes?

Contact the gift-card issuer immediately through its official website or independently obtained support details. Explain that the codes were disclosed in a suspected scam, and ask whether the balance can be protected or recovered. Keep the card, purchase receipt and messages. Recovery is not guaranteed; acting quickly gives the issuer an earlier opportunity to help.

The FTC's warning recommends keeping copies of the card and receipt and reporting problems promptly to the gift-card company. In the United States, you can also report fraud to the FTC. Elsewhere, use the relevant fraud-reporting or law-enforcement channel for your location. Tell your employer promptly rather than waiting to see whether the sender reimburses you.

If you also entered a work password on a page linked from the message, tell IT that credentials may have been exposed. That is a separate issue from the gift-card loss and needs its own response.

A team rule that works beyond this one scam

Make independent verification routine for unexpected requests to spend money or disclose payment credentials. Give staff permission to stop and check, including requests carrying an executive's name. A short rule is easier to follow under pressure: no gift-card purchase or code disclosure based only on an unexpected message.

The same habit helps with a different payment problem: a familiar supplier announcing a new bank account. Our guide to verifying changed supplier bank details before paying covers that workflow separately.

Where an additional email-security layer fits

SeguraDoc adds AI-assisted scam and impersonation checks to new email in a compatible existing mailbox; you keep your provider, address and usual email app. It is an additional layer, not a replacement for your spam filter or purchasing controls. You can turn filtering off or disconnect the inbox.

No filter catches every scam, and an unflagged message does not prove who wrote it or authorize a purchase. Keep the independent check even when a request appears in your normal inbox.

If unexpected requests in an executive's name are a concern for your team, review SeguraDoc's pricing and setup options for an additional check on incoming email. Keep the final decision to buy gift cards with a verified person and your established approval process.