Gift-Card Scams: 3 Variants and the FTC's One-Sentence Rule

An employee receives an urgent "from the CEO" email or text asking them to buy gift cards for a company event. The address looks legitimate or is spoofed; the request is timed when the real executive is in meetings or traveling. The employee buys the cards, sends the codes, and the reimbursement never arrives. Per the FBI, this is a top BEC sub-variant; the FTC issued a January 2026 consumer alert titled "No, that's not your boss asking you to buy gift cards."

A different victim's story illustrates how the script lands when the employee is new and conflict-averse. The author of an r/Scams thread (315 upvotes) describes their first week at a new marketing firm. Mid-afternoon they received an email that appeared to be from the CEO, sent to the employee's personal email rather than work email "because I'm in back-to-back meetings and don't want to miss this." The CEO needed help with a client appreciation gift — could the employee buy ten $100 Amazon gift cards from the closest Walgreens, send photos of the codes, and submit for reimbursement when they got back to the office? The request was urgent because the CEO needed to send the cards within the hour. The employee, eager to make a good impression, drove to Walgreens and bought $1,000 in Amazon cards. They sent the photos. They never heard back. The real CEO had been in a leadership offsite all afternoon and had sent no such email; the message had used a lookalike domain (the real domain plus an extra character) that was easy to miss on a phone screen.

The FBI's Phoenix Field Office published a Tech Tuesday alert documenting the script's structural fit with broader Business Email Compromise patterns. The variant works because it exploits two reliable structural features of corporate communication: executives do occasionally make unusual requests by email or text, and employees are conditioned not to question those requests too aggressively. The scammer's research is light — the company name, the executive's name, the employee's name and contact info (often scraped from LinkedIn or a public team-page), and a plausible-sounding pretext. The send timing is calibrated to when the real executive is unreachable, so the employee can't immediately verify. The FTC's January 2026 alert puts the response simply: "No, that's not your boss asking you to buy gift cards." If the request feels off, it is.

What stops it is verification through a separate channel. If a boss-level email or text asks you to buy gift cards, do not respond to that channel. Verify through a different channel — a face-to-face hallway conversation, a phone call to a number you already have for the executive, a Slack DM you initiate yourself. Real executives welcome verification calls; scammers escalate the urgency to discourage them. If the verification confirms the request was legitimate (extremely rare), proceed normally. If the verification confirms it was fake (the common case), report to your IT or security team, file at reportfraud.ftc.gov, and forward the email or text headers to your security team for analysis. If you have already purchased and sent codes, call the issuer's fraud line on the number from the back of the cards within the first hour — recovery is possible only if the codes have not yet been redeemed.

The boss-impersonation variant runs in corporate inboxes. The next variant runs everywhere else — phone, email, text — under whatever government or service brand the scammer chooses to wear.

A caller poses as a government agency, utility company, or tech-support service and demands urgent payment in gift cards to resolve a fabricated emergency — back taxes, jury-duty fine, utility shutoff, computer infection, suspended Social Security benefits. The victim is coached to a retailer, told which brand to buy, and walked through reading the codes back. No legitimate authority accepts gift cards. The FTC's one-sentence rule covers every script variant.

The variant is the universal extraction layer that sits on top of nearly every other elder-targeted phone scam in this corpus. The IRS-impersonation version (covered in detail on the Medicare & Elder-Targeted Scams page) demands gift cards as "back tax" payment. The jury-duty version demands them as a "court fine." The utility version demands them as an "emergency reconnection fee." The tech-support version demands them as an "antivirus subscription" or "refund overpayment." The Microsoft/Apple-support pop-up version demands them as a "diagnostic fee." Every variant terminates at the same retail counter: a victim with a stack of physical gift cards, a phone pressed to their ear, and a scammer on the other end coaching them through the code-transfer.

The retail-counter perspective is documented across r/retailhell, r/lossprevention, and r/Scams. The 989-upvote r/retailhell thread that opens this page is one example; the r/Scams thread "[US] How does this gift card scam work? Did the cashier scam me?" (259 upvotes) is another, focused on a victim trying to understand after the fact why the cashier seemed concerned. The volume is high enough that most major U.S. retailers — Target, Walmart, Best Buy, CVS, Walgreens — have implemented cashier-training programs that prompt staff to ask scripted questions when a customer presents a large stack of high-denomination gift cards. The questions ("Is this a gift?" "Who asked you to buy these?") are designed to break the scammer's script by introducing a friendly third party. When the cashier intervention works — as in the r/retailhell hook story — the customer leaves the store with their money intact. When it fails, the cards leave with the codes already photographed and sent.

If a stranger on the phone tells you to pay any agency or service via gift cards, hang up. The IRS does not accept gift cards. The Social Security Administration does not. Sheriffs, courts, utility companies, tech-support services, and your bank do not. Verify any "agency" call by hanging up and calling the agency's published main number from their official website — never the number that called you, never a number provided by the caller. Real agencies welcome callbacks and provide caller ID + case-number verification. If you have already purchased and sent gift cards, call the issuer's fraud line (Apple 1-800-275-2273, Target 1-800-544-2943, Walmart 1-888-537-5503, Amazon 1-888-280-4331) within the first hour — recovery is possible only if the codes have not been redeemed. Then file at reportfraud.ftc.gov, at ic3.gov for losses over $1,000, and at your state attorney general's consumer-protection unit.

The first two variants attack the victim through pretext. The third variant attacks the gift card itself — before any victim has even bought it.

Thieves tamper with physical gift cards on retail display racks before legitimate buyers purchase them. Methods include barcode-sticker overlay (your payment loads onto the scammer's card), blister-pack heat-reseal (scammer recorded the numbers; drains the moment you activate at checkout), and NFC tap-to-clone skimming. Maryland passed the first state law against this in 2024; Target redesigned its gift cards with blank codes and cashier-applied security labels.

The mechanism was explained at scale by an r/explainlikeimfive thread (1,007 upvotes) titled "ELI5: How do scammers extract money from the gift cards they get?" The top community answer walked through the ecosystem: scammers operate gift-card resale markets where cards with confirmed balances trade for 70-85 cents on the dollar, scammers run automated balance-checking bots that hammer issuer APIs to detect when a tampered card has been activated, and scammers maintain bulk-redemption infrastructure that converts cards to cryptocurrency, online merchandise, or other gift cards within minutes of activation. The card-draining variant fits into this ecosystem at the "supply" end: the thief in the retail aisle isn't the same person who eventually drains the balance; they sell the card numbers (or the access to the cards) into a wholesale market that handles the redemption. The vertical integration is what makes the scheme economical at scale.

Per TheStreet's coverage of FTC and BBB warnings: "Thieves are using several methods, including fake barcode stickers that redirect your money to a criminal's card, packages resealed with heat tools after thieves record the numbers, and tap-to-clone NFC skimming, allowing funds to be stolen instantly." The retailer-side response has been substantial. Target announced a redesigned gift card in 2024 with a blank space where codes used to be — a cashier applies a security access label at checkout, which simultaneously activates the card and applies tamper-evident seal over the code. Walmart, CVS, and Walgreens have rolled out similar measures. Maryland's Gift Card Scams Prevention Act of 2024 — the nation's first state law against card-draining — requires retailers to take similar precautions. Other states have draft legislation in committee.

For a buyer, what works is upstream of the rack. Don't buy gift cards from the front of a store display rack — those have been there longest and have the most opportunity for tampering. Buy from the back of the rack, ask a cashier to retrieve cards from behind the counter, or — best — buy digital gift cards via the retailer's official app or website. Run your finger over the back of any physical card to feel for stickers placed over the barcode or PIN; any tactile bump is a red flag. Check the packaging for resealing signs (heat-shrunk plastic, glue residue, unusual creases). At retailers with secure-cashier programs (Target's blank-code redesign, several state-level requirements), ask the cashier to apply the security label at checkout. Verify the card balance via the retailer's official app or website immediately after activation. If the balance shows zero or partial when you've just bought the card, you've bought a drained card — return immediately to the store with the receipt and call the issuer's fraud line.