Part of our Scam Spotlight series — plain-language breakdowns of specific phishing and scam patterns we see, building on our Understanding Spam and Phishing Emails (Basics) article.
Someone claiming to be a boss, coworker, pastor, family member, or even a stranger asking for a small favor sends a message asking you to buy gift cards (Amazon, Apple, Google Play, Visa, etc.) and send them the codes on the back. The request is usually framed as urgent, personal, and slightly unusual — a “quick favor” rather than a normal business transaction, because gift card codes are as good as cash and impossible to trace or reverse once sent.
Subject: Favor
From: Pastor Mike <pastormichael.reach@gmail.com>Hi, I'm visiting a member in the hospital and need to get them a gift as a surprise before I leave. Can you pick up a $200 Apple gift card and send me the code from the back? I'll pay you back this weekend. Please keep this between us for now, I want it to be a surprise.
A free email address (Gmail, Yahoo, etc.) instead of the person's usual business or organization email.
Payment specifically requested as a gift card code — this is the single biggest red flag of this entire scam type. Legitimate requests almost never require gift cards.
A reason to keep it secret or avoid talking to the person directly, so you can't easily verify the request.
A promise to “pay you back” later, which never actually happens.
The request comes from someone in a position you'd want to help quickly without questioning it — a boss, clergy member, or family authority figure.
Don't buy anything or send any codes.
Contact the person directly by phone or in person, using a number you already know — not one provided in the message.
Remember: no legitimate organization, employer, or family emergency requires payment in gift cards. If you hear that phrase, it's a scam.
Report the message to whoever the sender is impersonating (your actual employer, church, etc.) so they can warn others.
If you've already purchased and sent gift card codes:
Contact the gift card issuer immediately (Amazon, Apple, Google, Visa, etc.) — explain it was used in a scam. In some cases, if the card hasn't been redeemed yet, they may be able to help.
Report it to your local police department and, in the US, to the FTC at reportfraud.ftc.gov.
Let the person or organization who was impersonated know, so they can alert others who may be targeted too.
Understanding Spam and Phishing Emails (Basics)
Scam Spotlight: 'CEO Fraud' Wire Transfer Requests
Scam Spotlight: Fake Package Delivery Notifications