Holiday Gift Card Requests: The Two-Question Check Before Anyone Buys

The message is usually short. "Are you at your desk? I need a quick favor." It appears to come from a managing partner or the office manager. A few replies later, the favor arrives: pick up several gift cards for client thank-yous, scratch off the backs, and send photos of the codes. Please keep it quiet, it's a surprise.

In March, that request would sound odd. In December, it sounds like the holidays. That is exactly why it works, and why a simple, shared check is worth setting up before the season starts.

What the numbers show

The Anti-Phishing Working Group (APWG), an industry coalition, publishes quarterly reports that include data from members who examine business email compromise (BEC) attempts. In the fourth quarter of 2025, gift card requests were the most common way those attackers tried to get paid, making up 59 percent of the BEC attempts tracked. Wire transfer requests made up 17 percent.¹ The pattern held into 2026: in the second quarter, gift cards were again the most common BEC payment type, at 54 percent.²

Those figures describe attempts, not losses, so they measure something different from the FBI's numbers. For scale, the FBI's Internet Crime Complaint Center (IC3) received 24,768 BEC complaints in 2025, with about $3.05 billion in reported losses.³ Not every incident is reported, so the real total is higher.

For a small firm, the useful takeaway is this: if someone in your office receives a fake request from "the boss" this season, there is a good chance it will ask for gift cards rather than a wire.

Why December makes the request easier to believe

An FBI field office described the timing plainly in a holiday warning about these schemes: "'Tis the season, after all, for presents, incentives, and end-of-year bonuses."⁴ The same warning describes fraudsters asking employees to buy cards for purposes such as a Christmas party.⁴

Several ordinary things line up in December at a professional-service firm:

• Gift cards are a normal purchase. Many firms do buy them for clients, referral partners, and staff at year end.
• Leaders are harder to reach. Partners are traveling, in client meetings, or out of the office, so "I can't talk, just handle it" seems believable.
• Secrecy has a built-in excuse. "It's a surprise for the team" explains why the employee shouldn't mention it to anyone.
• Everyone is busy. Year-end deadlines leave less time to stop and wonder.

We aren't aware of public data that precisely measures a December spike in these requests. The point is not that December is uniquely dangerous. It's that the request fits the season well enough to skip the usual second look.

How the request usually unfolds

The FBI describes a consistent pattern. The scam starts with a spoofed email or text that appears to come from a person of authority, often an executive or someone in HR. The employee is asked to buy gift cards, frequently several of them, and then to send back the card information, including the number and PIN.⁴ The FBI also lists warning signs: a sender address that differs slightly from a real colleague's, awkward phrasing, and pressure to buy quickly.⁴

Once the codes are sent, the money is effectively gone. Whoever holds the card number and PIN can drain the balance without ever touching the physical card.⁴

The FTC's consumer advice is blunt: "Gift cards are ONLY for gifts."⁶ It also notes that "No real business or government agency will ever tell you to buy a gift card to pay them."⁵ Those are good rules, but the holiday version of this scam is designed to get around them. The request is for gifts. So employees need a check that works even when the story is plausible.

The two-question check

Before anyone buys gift cards at someone else's request, they ask two questions.

1. Did I confirm this with the person, through a channel I already had? That means calling them at the number in the firm directory or your phone's contacts, walking to their office, or starting a new message in the firm's internal chat. It does not mean replying to the email or text that made the request, or calling a number that came with it. The FBI's advice for these requests is the same: confirm with a follow-up phone call.⁴

2. Does this match how our firm actually buys gifts? Every firm has a normal way of doing this: a particular person buys them, on a particular card, with a receipt that goes to the bookkeeper. Real gift purchases end with cards handed to people or mailed to clients. They do not end with codes sent to someone by email or text. A request to send the numbers and PINs is the clearest warning sign in the FBI's list.⁴

If the answer to either question is no, the employee stops and checks. No one at the firm should ever get in trouble for verifying a request from a leader, even a real one.

A hypothetical example

Imagine an assistant at a 25-person accounting firm receives a text on a Friday afternoon from a number labeled with a partner's name: "In a client meeting, can't call. Need 6 gift cards at $200 each for the staff party. Send me pics of the backs when you have them." The partner really is at a client meeting, and the firm really does have a party next week.

Question 1: the assistant hasn't confirmed anything; the text came from a number that isn't the partner's usual one. Question 2: the firm's office manager normally buys party gifts on the firm card, and nobody has ever asked for photos of codes. Both answers are no. The assistant calls the partner's known cell, leaves a voicemail, and tells the office manager. Nothing is bought until the partner calls back.

Set it up this week

The check only works if people know it's expected. A few steps make it the norm:

• Write down how your firm buys gift cards. One paragraph: who buys them, how they're paid for, who approves, and where the cards go. Share it with everyone before December.
• Have leaders say the rule themselves. A short note from the managing partner works well: "I will never ask you by email or text to buy gift cards and send me the codes. If you get a message like that from me, call me." The people most likely to be impersonated are the most convincing messengers.
• Make checking safe. When someone calls to verify a request, thank them, even if the request was real.
• Repeat it at the right moments. A reminder before the holidays and before leaders travel does more than a line in an annual training.
• Make reporting easy. Tell staff exactly where to forward a suspicious message. For the other warning signs worth pausing on, see Five Email Red Flags Worth Checking Before You Click or Pay.

If someone already sent the codes

Move quickly, and keep the focus on recovery rather than blame:

• Contact the company that issued the gift card right away, explain that the card was used in a scam, and ask about a refund. Keep the cards and the store receipt.⁵
• Report it to the FTC at ReportFraud.ftc.gov⁵ and to the FBI at IC3.gov.⁴
• Tell whoever manages your IT. If the request came from a real firm email account rather than a look-alike, that account may need attention.

An employee who reports quickly gives the firm the best chance of limiting the loss. One who fears being blamed may wait, and waiting helps no one.

The same rule, a bigger dollar amount

In the same APWG data, wire transfer requests averaged $50,297 in the fourth quarter of 2025.¹ The dollar amounts differ, but the habit that stops a gift card scam is the same one that protects larger payments: verify through a channel you already had, and follow your normal process. If your firm hasn't written that down for vendor and bank-detail changes, Payment-Change Requests: A Verification Policy Your Firm Can Adopt in a Day walks through it. The Email Fraud Readiness Checklist also includes a section on executive-impersonation risk you can review with your team.