Is That Text From Your Boss Real? If It Asks for Gift Cards, It's Not Your Boss

Yes — it's a scam; the FTC's verdict is categorical. The script is an unexpected message from your “boss” — right name, new number or lookalike address — asking for an “urgent favor” while they're stuck in a meeting: buy gift cards, scratch the backs, send photos of the numbers and PINs. Only scammers ask for gift card numbers and the PIN — those numbers are the money, even without the physical card. Check with your boss on a number you already know is real; never reply to the message that asked.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

Why this question never goes away

The script is short: an unexpected text or email from your “boss” — right name, maybe a lookalike address or new number — asking for an “urgent favor” while they're stuck in a meeting. Buy gift cards, scratch the backs, send photos of the numbers and PINs. Some versions dress it up as “Google certificates,” which means gift cards in different words. The FTC's January 2026 alert closes the case in one line: that person is not your boss, and only scammers ask for gift card numbers and the PIN — those numbers are the money, even without the physical card. The defense takes thirty seconds and costs nothing: check with your boss on a number or email you already know is real — never by replying to the message that asked. If you already sent the numbers, keep the cards and receipts, report to the gift-card company immediately (speed decides whether money comes back), and file at ReportFraud.ftc.gov.

Five red flags — any one is enough

The “urgent favor” frame — unexpected message, right boss-name, wrong channel (new number, lookalike address).

The ask is gift cards — any workplace errand that ends in gift-card numbers is the scam, full stop.

Euphemisms for the cards — “Google certificates,” “vouchers,” “codes for a client event.”

Secrecy and speed — “I'm in a meeting, don't call,” “handle this quietly before 5.”

It fails the 30-second check — your real boss, reached at their known number, has no idea what you're talking about.

Your next three moves

Verify through a channel you open yourself — call or message your boss on a number or email you already know is real. Never verify by replying to the message that asked; thirty seconds on the known channel settles it.

Refuse the ask — no gift cards, no “Google certificates,” no photos of numbers and PINs, however urgent or secret the favor sounds. Only scammers ask for gift card numbers and the PIN; those numbers are the money, even without the physical card.

Report it at reportfraud.ftc.gov and warn your workplace — and if you already sent the numbers, keep the cards and receipts and report to the gift-card company immediately; speed decides whether money comes back. Check any link or number in the message via the $2 instant check.

The text used my boss's exact name — isn't it really them?

No — the script uses the right name on the wrong channel: a new number or a lookalike address, an “urgent favor,” and a meeting they supposedly can't leave. Verify on a number or email you already know is real — never by replying.

What are “Google certificates” my “boss” asked for?

Gift cards in different words — a euphemism for the same ask. Any workplace errand that ends in gift-card numbers and PINs is the scam, full stop.

I already sent the gift card numbers — can I get the money back?

Keep the cards and receipts and report to the gift-card company immediately — speed decides whether money comes back — then file at ReportFraud.ftc.gov and warn your workplace.

Why do scammers want gift card numbers specifically?

Because the numbers are the money — even without the physical card. Only scammers ask for gift card numbers and the PIN, which is why the FTC's verdict on the “urgent favor” script is categorical.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.