Boss asks you to buy gift cards? It might be a scam!

November 8, 2018

The gift-giving season is almost here, are you ready? If you’re like me, you are scrambling to find just the right present for that person on your list who seems to have everything. Don’t worry though, there’s always the gift card to fall back on.

Even though that gift might not seem personal enough to give away during the holidays, gift cards are in high demand. Consumers are projected to spend around $160 billion on gift cards in 2018.

Gift cards will always be hot items, for sure. However, if your boss emails you to buy a bunch of them for work, you better watch out! There’s a growing scam you need to know about.

BEC gift card scam

The FBI has issued a new warning about Business Email Compromise (BEC) gift-card scams.

The Internet Crime Complaint Center (iC3) said that it has received an upsurge in the number of complaints of fraudulent emails requesting employees to purchase gift cards for their companies.

Basically, a BEC scammer attempts to trick the victims into buying gift cards from a variety of merchants, such as iTunes, Google Play or Amazon, by impersonating executive email accounts.

These attacks are initiated either by social-engineering tricks, email and text spoofing or malware, targeting upper management, accounting and HR departments. The emails appear so legitimate, it’s easy for employees to get taken.

The scammers will even request their unsuspecting victims to purchase cards from multiple brick-and-mortar stores like Walgreens, Walmart or Target to avoid gift-card purchase limits.

Scammers are shifting gears

IC3 revealed that it has received more than 1,100 complaints between January 1, 2017, and  August 31, 2018, from technology, real estate, legal, medical, distribution and supply, and religious sectors.

Although the average reported loss per incident was less than $900, the increase in the number of BEC gift-card scams has pushed the combined losses to over $1 million!

Here’s the interesting part – the BEC gift-card scams were still not statistically significant in 2017. The huge surge started between March and August of 2018, and it’s been on a steady rise ever since.

Based on this surge, it looks like BEC scammers are shifting away from traditional wire transfers and are relying instead on smaller but numerous gift-card payouts instead.

Not only are inexpensive gift-card purchases easier for a company to absorb as a loss, buying gift cards is also relatively simple. Additionally, since they only require a code for verification, the transfers are untraceable. 

In fact, gift cards are also the preferred method of payment of many ransomware, extortion and tech-support scammers.

So how do we protect ourselves from this growing scam?

BEC gift-card scams will only get worse, especially during the holiday season, so here are a few tips to protect yourself and your organization:

• Be vigilant with email communication. Check email addresses carefully, especially those coming from executives for something that involves purchases and money matters. A missing character on the address could spell the difference between safety and compromise.
• Always review, verify and scrutinize any message from your boss requesting gift-card purchases, no matter what amount.
• Think of using two-factor authentication for your business email accounts. Use known phone numbers for verification and avoid displaying these phone numbers on email correspondence.

If you are a BEC gift-card victim, please contact the FBI to report the crime and file a complaint with the Internet Crime Complaint Center (www.IC3.gov).

Click here to read IC3’s full report.

Tags: Amazon, extortion, Google, hackers, holiday season, internet, malware, ransomware, scams, verification