Gift Card Email From Your Boss? The Two Scams Houston Businesses Need To Know

Almost always, yes. The trick runs in two directions, and knowing which one you're looking at tells you how to respond.

Business email compromise (BEC) is a scam where an attacker poses as someone you trust, often the CEO, owner, or a vendor, to trick you into sending money, gift cards, or login details.

Both gift card versions are business email compromise. The difference is which way the value flows. In the first, your money flows out: you buy the cards. In the second, your access flows out: you hand over a password. Sometimes the two connect, since a password stolen in the second scam becomes the real boss account that makes the first scam far more convincing. Either way, the email rarely touches your systems at all. It just wears a name you trust.

• Display-name spoofing the name says "Your Boss' Name," the actual address is a stranger's.
• Lookalike domains cinchops.com becomes cinch0ps.com, or a free Gmail account.
• Account takeover the real mailbox is compromised, so the email genuinely comes from your boss.

The money is real. The FBI's Internet Crime Complaint Center (IC3) reported that business email compromise drove more than $3 billion in losses in its 2025 report, making it one of the highest-loss cybercrime categories tracked. Gift cards show up constantly because they're fast, hard to reverse, and easy to buy on a lunch break. Here's how the two versions compare.

This is classic CEO fraud. It follows the same script almost every time, which is good news once you know the pattern.

The attacker opens with a harmless question to confirm you're available, then escalates to an urgent gift card request and asks you to keep it quiet.

It starts with bait: "Are you at your desk?" or "Do you have a minute?" Answering tells the scammer you're live and willing. Next comes the task, framed as a favor for a client, a board gift, or employee rewards. Then the pressure: they're heading into a meeting, can't take a call, and need it handled now. Secrecy is built in, because secrecy stops you from walking over to your boss's office and asking. Houston firms with remote or hybrid staff are especially exposed, since "just email me the codes" feels normal when half the team isn't in the building.

How to handle it: do not buy anything and do not reply. Verify with your boss on a number you already have, then report the email.

• Verify the person, not the email. Call or text your boss on the number already in your phone, or walk to their office. Never use contact details from the suspicious message.
• Check the real sender address. Expand the display name to see the actual address and the reply-to. A "boss" emailing from a Gmail account or a misspelled domain settles it.
• Don't buy the cards, and don't scratch off any codes. If the message also has a link or attachment, leave it alone.
• Report it. Forward it to your IT team or managed IT provider so they can check whether coworkers got the same message and whether a mailbox was compromised.
• If you already paid: call the gift card issuer immediately to try to freeze the funds, tell your manager, and report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Speed matters more than embarrassment.

This one flips the script. The bait isn't a favor, it's a reward, and the goal is your password, not store credit.

A fake gift card "from your boss" is a phishing lure. The email says a thank-you or bonus is waiting and asks you to click a link or confirm your details to claim it.

Instead of asking you to spend money, the email says your boss, HR, or the CEO has a gift card waiting, a thank-you, a holiday bonus, an employee reward, and all you have to do is click to claim it. The link doesn't lead to a gift card. It leads to a fake Microsoft 365 or company login page built to steal your password, or to a download that plants malware. The scammer isn't after gift cards at all. They want your credentials so they can read your email, find invoices, and run the Scenario 1 attack on your coworkers from your real account. The reward framing works because nobody wants to look ungrateful by questioning a gift.

How to handle it: don't click. Verify the "gift" with your boss or HR on a known channel, then report the email.

• Don't click the link or open attachments. A real gift would never need your password.
• Hover, don't tap. Check where the link actually goes. A login page that isn't your normal company sign-in is fake.
• Verify before acting. Ask your boss or HR on a known number or in person whether the reward is real.
• Report it to your IT team or cybersecurity team so they can block the link and warn the rest of the company.
• If you already clicked and entered a password: change it right away, turn on or reset multi-factor authentication, and tell IT immediately so they can check your mailbox for rules the attacker may have added.

No single tool fixes either one. You layer technical controls under one simple human rule.

The fix is a written verification rule for any payment, gift card, or "claim your reward" request, backed by email authentication, multi-factor authentication, link protection, and short, regular staff training.

The rule that stops most of these costs nothing: any request to buy gift cards, move money, or click to claim a reward gets confirmed out loud, on a known number, no exceptions, even when "the boss" says it's urgent. Make it policy so a junior employee never feels awkward pausing a CEO request. Underneath that, a few controls do the heavy lifting, and a good managed IT partner sets them up once and keeps them running.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

• Through cybersecurity services, we set up email authentication, advanced filtering, link protection, and external-sender warnings that catch both spoofed requests and malicious "claim your gift card" links.
• With managed IT support, we enforce multi-factor authentication and monitor mailboxes for the account takeovers behind the worst BEC attacks.
• We run short, regular security awareness training so your staff recognize both gift card scripts and feel safe pausing to verify.
• We support businesses across Houston and Katy, including law firms and CPA firms that handle sensitive client funds and data.

Gift card fraud isn't a problem you can buy your way out of with one tool. It's a people problem wrapped in an email, and shutting it down takes the right controls running quietly in the background plus a team that knows to stop and verify. That's the combination we set up and keep running for Houston-area businesses. If a suspicious "boss" email lands in someone's inbox, or you just want both gift card scams closed off before they cost you, call CinchOps at 281-269-6506 or reach us through our contact page.