Common warning signs include urgent requests for gift card purchases, pressure to act within hours, unusual changes in communication channel, and messages that mimic executive tone too well. Other clues are spoofed display names, lookalike domains, and requests that ask employees to bypass normal approval paths. The more the message demands speed and secrecy, the more likely it is malicious.
How the scam is being weaponised in real workplaces
What makes these campaigns dangerous is not the gift card itself, but the way attackers turn a simple purchase request into a fast-moving social engineering event. The message is usually crafted to look routine, so the employee focuses on helping rather than validating. Once urgency, secrecy, and authority cues are combined, the scam starts to behave like an active intrusion attempt instead of a one-off fraud.
A useful tell is escalation pressure. The attacker wants the employee to leave the normal buying path, avoid discussion, and treat the request as exceptional. When that happens, the scam is no longer relying on deception alone, it is exploiting process bypass and time pressure to reduce the chance of review.
- Requests arrive as an exception, not a normal procurement task.
- The sender pushes for speed, privacy, or off-channel handling.
- The language is polished enough to fit the organisation’s tone, but still unnaturally urgent.
- The request is framed as too sensitive to verify through standard approval steps.
A practical reference point is the broader social engineering pattern described in MGM Resorts Breach 2023, Scattered Spider, where attacker success depended on manipulating trust, timing, and normal human workflow rather than technical exploitation.
Signals that the message is being actively adapted for employees
The strongest signs are not just that a gift card request exists, but that the wording, channel, and timing appear tuned to a particular person or team. A spoofed display name, a lookalike domain, or a message that mimics an executive’s writing style suggests the scam is being personalised. That usually means the attacker has done enough reconnaissance to increase conversion.
Another clue is channel drift. If the same request moves from email to chat, text, or a personal message after a slow response, the attacker may be probing for the easiest path. That is a material warning because it shows the campaign is being adjusted in response to resistance, not merely broadcast blindly.
- Display names or reply paths look close to a real executive or manager.
- Domains, signatures, or response addresses are only slightly wrong.
- The scam shifts to another channel after any hesitation.
- The message includes just enough internal detail to feel plausible, but not enough to stand up to verification.
For teams that want to recognise the pattern at a control level, FIRST EPSS is not about fraud itself, but it reflects the same operational logic: prioritise what is actively being attempted, not only what is theoretically possible.
Risk and Threat Considerations
Gift card scams become more serious when they are used as a testing ground for employee compliance, because a successful purchase can confirm which staff will bypass controls under pressure. The immediate loss may be small, but the real risk is that the same social engineering style can later be reused for payroll diversion, account access, or other higher-impact fraud.
Failure mechanism: The attacker uses urgency, authority cues, and channel switching to override normal verification habits, then learns which employees will act without independent confirmation. That makes the campaign easier to scale and improves future targeting.
Impact: Organisations can lose money directly, but they also risk normalising unsafe exceptions, weakening approval discipline, and creating a trusted path for more damaging impersonation attempts.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Gift card scams are social engineering campaigns that use deceptive messages to induce action. |
| T1660 — Phishing: Spearphishing Link | Lookalike domains and channel shifts often accompany targeted impersonation attempts. | |
| Recommendation — Map suspicious requests to phishing indicators and train users to verify unexpected payment demands. Inspect domain and sender anomalies before users act on requests that reference payments. | ||
| NIST CSF 2.0 | PR.AT — Awareness and Training | Employees need role-specific training to recognise urgency, impersonation, and approval bypass cues. |
| DE.CM — Continuous Monitoring | Message anomalies, spoofing patterns, and repeated attempts are detection signals worth monitoring. | |
| Recommendation — Train staff to challenge urgent payment requests and verify them through a second channel. Monitor for impersonation patterns and repeated anomalous requests across email and chat. | ||
| CIS Controls v8 | 14 — Security Awareness and Skills Training | Gift card scams exploit human judgment, so awareness controls directly reduce success rates. |
| Recommendation — Deliver recurring simulations that teach employees to stop and verify unusual purchase requests. | ||
Practitioner Guidance
What to prioritise: Treat any gift card request that arrives with urgency, secrecy, or channel inconsistency as a verification event, not a purchase request. The key judgement is whether the message is trying to compress decision time, because that is usually the attacker’s main advantage.
What to verify: Check whether the request came through the person’s normal approved channel, whether the wording matches their usual style, and whether the request can be confirmed through an independent path already known to the employee. If the request depends on speed to succeed, it deserves suspicion even when the sender name looks familiar.
Practitioner takeaway: The most important indicator is not the gift card request itself, but whether the sender is trying to prevent verification. Once secrecy and urgency are present together, assume the campaign is being actively optimised for a rushed human decision.
