Impersonation scams hijack the trust attached to a name. Fraudsters clone a real company's branding to post fake jobs, or — more dangerously for new hires — pose as a senior executive who "urgently" needs a favor. The classic payload is gift cards: you're asked to buy them for a client, an event, or employee rewards, then send the codes. Once a gift-card code is shared, the money is gone and untraceable.
This is a form of business email compromise (BEC), one of the costliest scam categories in the world. It works because it weaponizes hierarchy and urgency: a new employee eager to impress an executive is unlikely to push back.
The new-hire gift-card play
Shortly after you start (or during onboarding), you get a text or email from the "CEO" or your "manager." They're traveling or in a meeting and can't talk. They need you to quietly buy gift cards — Apple, Amazon, Google Play — and send photos of the codes, promising fast reimbursement. The secrecy and time pressure are the scam; real executives don't run errands this way.
- "Are you at your desk? I need a quick favor, keep this between us."
- "Buy five $200 Apple gift cards for client rewards and send me the codes."
- "I'm in back-to-back meetings — you'll be reimbursed today, I promise."
Fake-company job posts
The other face of impersonation is the cloned employer: a real brand's logo and name on a fake listing, with an offer that routes you to a look-alike email domain ([email protected]). From there it becomes an upfront-fee, identity-harvest, or check scam. The brand is borrowed to buy instant credibility.
How to verify before you act
Slow down and use a second, known channel. Call the executive or HR at a number you already have — never the one in the message. Check the sender's full email address, not just the display name. Remember the ironclad rule: no legitimate employer will ever ask an employee to buy gift cards for business purposes. That request is always a scam.
Red flags to remember
- Any request to buy gift cards and share the codes
- An "executive" contacting you urgently via personal text or a new number
- Secrecy: "keep this between us," "don't loop in anyone"
- A company email on a look-alike domain instead of the official one
- Pressure to act immediately with a promise of reimbursement
What to do if you're targeted
- 1Do not buy gift cards or send codes; verify via a known channel first.
- 2Confirm the request directly with the real person or HR using trusted contact info.
- 3Report suspected BEC to your employer's IT/security team.
- 4Report to the FBI IC3 (ic3.gov) and the FTC; gift-card fraud can also be reported to the card issuer.
Frequently asked questions
Would a real manager ever ask me to buy gift cards?
No. Legitimate businesses never ask employees to purchase gift cards for company purposes and send the codes. This is a defining sign of an impersonation/BEC scam, regardless of how convincing the sender seems.
The email name says it's my CEO. Isn't that proof?
Display names are trivial to fake. Check the full email address, and verify urgent or unusual requests through a separate, known channel before acting.