Carnegie Mellon University
Computing Services  ›  Information Security Office  ›  Training and Awareness  ›  Don't Take the Bait  ›  gift-card-scams

Gift Card Scams

While not new, gift card scams are on the rise and can result in a victim losing hundreds or thousands of dollars. In a typical scam, an employee receives an email or a text message that pretends to be from their co-worker, boss, or another senior figure or person of authority. It asks them to buy gift cards and send them photos of the backs, for reasons that will supposedly be explained later. The scammer may ask you to communicate with them via text message or over the phone.

How to Spot a Gift Card Scam

  • Inspect the sender's email address to confirm it's actually coming from that person. Scammers will often send the email from a random email account and change the Display Name of the email address to either your boss, supervisor, or director. If the message came in the form of an unfamiliar text message, reach out to the supposed sender through a trusted channel such as an email address found in the organization directory.
     
    email address and display name do not match
    Sample Fake Sender

  • A Gift Card Scam Email Message will:

    • Indicate some level of urgency, such as indicating they are currently busy or are heading into a meeting and need your help ASAP.
    • Possibly include a subject line of  "are you are available?" or "URGENT REQUEST"
    • Ask you to do them a "favor".
    • Ask you to purchase numerous gift cards with the promise of reimbursement.
    • Ask for you to scractch off the activation codes on the back and provide them over email, text, or by phone.
    • Possibly have typos and grammatical errors.
    • Possibly not include the sender signature, but rather "Sent from my iPad" in order to make it appear as if the person is mobile and away from their desk.

What To Do

  • Ask yourself, "would this person really ask me to do this?"
  • Call the sender to verify authenticity of the request or use the sender's email account on file in the CMU Directory
  • Do not reply to the email.
  • Do not purchase any gift cards.
  • Contact us so we can take additional steps and to help validate the authenticity of the email.

Information Security Office
iso-ir@andrew.cmu.edu
412-268-2044

Example Gift Card Scam Emails

Example 1

From: Director Name <DirectorName@andrew.cmu.edu.gmail.com>
To: CMU Employee <cmuemployee@andrew.cmu.edu>

Subject: Request...

I need you to do a chore to purchase Google Play gift cards from Target / Safeway or any other nearby store. Let me know when you receive this email for the amount and denominations you are to purchase then look forward to my response.

Director Name

Sent from my iPhone

Example 2

Jane, could you please email me back? I need a favor.

Example 3

Sally, are you on campus? I need you to handle a project. Very busy at the moment. Can't talk. Just send an email when you receive this. Thanks.

Example 4

I need you to pick up three Home Depot gift cards for our project.

Example 5

Good to hear from you. I need to get three iTunes gift cards for my niece. It's her birthday but I can't do this now because I'm currently traveling. Can you get them for me from any store around you? I'll pay back next week when I get back home.

Example 6

Sitting in a meeting right now, there is something i need you to do. Let me know when you are available.

Example 7

Hello, are you available? Please i need your assistance urgently.

Example 8

Hi, I was hoping you could help me get some amazon gift cards from
the store, I will reimburse you when I’m done with my conference, I need to
send it to someone now and it is very important because it’s one of my best
friend kid birthday and I fear I may not get it on time myself if I decide
to wait it out.

Example 9

Subject: Are you available?

Are you available ? I need you to handle something for me now, i'm currently in a meeting with limited phone call and also experiencing some difficulties at the moment, just reply my e-mail if you are available. Thanks

[Signature of a CMU person]

Example 10

I need you to personally run a task for me ASAP as I am occupied in a meeting at the moment and can't talk but will lookout for your reply  and let me know if you can get this done right now.

Sample 11

Subect: Give me a quick response
Please provide me with your personal text number.

[Signature of legitimate staff member]

Victim of a gift card scam?

If the scam involved payment with a Gift Card, report the gift card fraud immediately to the company. 
  • Report to Google Play (855-466-4438)
  • Report to Apple (1-800-275-2273 then say "gift card")
  • Report to Amazon (888-280-4331)
  • Report to eBay (866-540-3229 then say "representative" after the first prompt. Then say "gift card" after the next prompt.
If a different money service company was used for payment in the scam, immediately contact the company to report the fraud.

Also report the security issue to the Information Security Office at iso-ir@andrew.cmu.edu or by phone at 412-268-2044.

Don't see your card on this list? Search online for how to reach that card issuer. If there is not contact information available or the card issuer is reluctant to help, report the scam to the FTC.