“I need you to buy some gift cards, ASAP”: how CEO fraud starts

Picture a Tuesday afternoon. Your office manager gets an email from you: “Are you at your desk? I need a quick favour. I’m in meetings all afternoon so can’t talk, but I need some gift cards sorting for a client, ASAP.” It has your name on it, it sounds a bit like you, and it’s exactly the sort of thing a busy managing director might send.

Except you didn’t send it. That’s CEO fraud, sometimes called the fake boss scam, and it usually starts with a message far more harmless than a request for money. This blog is written for the person whose name is being used: what the scam looks like from your team’s side, why good staff fall for it, and the one message you can send them today that makes it much harder to pull off.

What is CEO fraud?

CEO fraud is when a criminal pretends to be a senior person in your business, usually the managing director, CEO, CFO or owner, and asks a member of staff to send money, buy gift cards or hand over sensitive information. It’s a form of phishing and a type of business email compromise (BEC), and it’s the flip side of whaling: instead of targeting the boss, the scammer becomes the boss. We explained how the different types fit together in phishing vs spear phishing vs whaling.

Cybercriminals don’t need to hack anything to impersonate executives. Your name, your job title and the names of your team are usually on your website and LinkedIn. That’s enough to set up a free email account in your name and start writing to your staff.

How CEO fraud starts

Most people picture the payment request as the scam. In the messages our service desk sees reported, the first email rarely asks for money at all. It asks for something small and easy to say yes to. These are real lines from fake boss emails we’ve seen:

• “Could you let me know your preferred cell number? I’d like to send a task brief directly to your phone.”
• “What number should I use to contact you by SMS?”
• “Re-confirm your personal WhatsApp phone number.”
• “Create a new WhatsApp group and reply with the group’s QR code.”

Others open with a simple “Are you available?” or “I need a quick favour”. None of them asks for anything that looks risky, so they’re easy to answer without a second thought. Look at “cell number” in the first one, though. Most British managing directors would say “mobile”, and small slips like that are often the only clue.
These come from a free Gmail or Outlook address with the director’s name on it, and they’re sent to whoever the scammer can find: the office manager, the accounts inbox, the info@ address, sometimes the whole team at once. We see this pattern regularly across the businesses we support, in every sector.

There’s no need to spoof your real email address. Most people read email on their phone, where the display name is what they see first. And because there’s no link or attachment, these emails bypass most spam filters and antivirus tools; there’s nothing malicious in them to detect.

The reason for asking for a phone number is simple. Once the conversation moves to WhatsApp or text, it’s out of your email system. Your spam filter, your external sender warnings and your phishing report button can’t see it any more. The scammer can add your profile photo from LinkedIn, and the chat looks like any other message from you. That’s why the clearest sign of CEO fraud is a request to move the conversation away from work email.

Then comes the gift card request

In the messages reported to us, the first ask is usually for a phone number. Gift cards are the request most often reported once the chat moves on, usually Apple, Amazon or Google Play. The scammer doesn’t always bother with WhatsApp, either. Sometimes the gift card or payment request comes straight in by email. The details are there to stop anyone checking: you’re in a meeting, it’s a surprise for a client or the team, it needs doing in the next hour, and please keep it confidential.

Security awareness training company KnowBe4 has tracked this scam for years and has seen scammers add a bribe: buy the cards for the clients and “take one for yourself” as a thank you. It’s a clever touch, because it makes the request feel like a perk from the boss rather than something strange.

Then comes the ask that gives the game away: send the gift card codes over, or a screenshot of them. Gift cards don’t need the physical card to be spent, and most are bought online with the code emailed straight over anyway. Once the codes are sent, the fraudster can spend the money straight away, and it’s very hard to get back.

Why do scammers ask for gift cards?

Gift cards are close to cash for a criminal. They can be bought on any high street or online in minutes, they don’t need a bank account to receive them, and the codes can be spent or sold on almost immediately. A bank transfer can sometimes be stopped. A gift card code that’s already been used usually can’t.

They also fit the story. A director buying a few gift cards for clients or staff at short notice doesn’t sound unusual, especially in the run-up to Christmas, which is when this scam tends to pick up.

It isn’t always about gift cards

Gift cards are the version most people have heard of, but the same trick is used to ask for other things. The request changes; the pressure, the secrecy and the “I can’t talk right now” stay the same.

• A confidential payment. “We’re buying a company and need to pay the deposit today. Keep this quiet until it’s announced.” Sometimes a fake solicitor is copied in to make it look official. This one goes to whoever can send money, usually the finance director or accounts team.
• Salary bank details. An email from a member of staff, or from you, asking payroll to change where a salary is paid before payday. This is known as payroll diversion, and it often isn’t noticed until the real person asks where their pay is.
• Staff or client information. A request for payroll reports, staff records, a client list or a contract. It can be used for identity fraud or to make the next attack more convincing.
• A payment request to the accounts inbox. We’ve also seen emails using a member of staff’s name sent to a shared accounts inbox, asking for a payment. Several people read a shared inbox, so the scam only needs one of them to act.

The answer is the same each time. Any request to send money, change bank details or share sensitive data gets checked another way, on a number you already hold, before anyone acts on it.

Why the fake boss scam works on good staff

The people most likely to fall for this aren’t careless. They’re helpful, they want to get things done for you, and they don’t want to bother you when you’ve said you’re busy. Every tactic in the message is designed to trick employees who trust you:

• Authority. It’s the managing director asking. Questioning it feels awkward.
• Urgency. “ASAP” and “within the hour” create a sense of urgency, leaving no time to think it through.
• No way to check. “I’m in meetings and can’t take calls” removes the most obvious check before it’s even considered.
• Secrecy. “Keep this between us” stops them mentioning it to a colleague who might spot it.

Smaller businesses can find it harder, not easier. In a team of 20 or 30, everyone knows the MD, favours are normal and requests often come by email or WhatsApp anyway. A message from you asking for help doesn’t stand out.

It catches out people who work in security too. KnowBe4 has written about a senior member of its own staff who was contacted on WhatsApp by someone posing as a fellow executive, with an urgent request for help with a money transfer. He spotted it because the scammer used his formal name rather than the nickname his colleague always used, and couldn’t answer a question about plans they’d made together. He then checked with the real person on the company’s own chat system. That’s the habit you want your team to have: verify it another way.

How common is CEO fraud in the UK?

In the government’s Cyber Security Breaches Survey 2025/2026, people impersonating an organisation or its staff, by email or online, was the second most common type of attack after phishing. It affected 12% of businesses overall, but 38% of medium-sized businesses, and after phishing, it was the attack businesses most often said had hit them hardest.

Those figures only count what businesses noticed and reported. A fake boss email that a sharp member of staff deletes without telling anyone doesn’t show up anywhere. And as more of these scams move from email to WhatsApp, fewer of them will reach the IT team at all.

What to tell your team

The most useful thing a managing director can do takes about two minutes. Tell your team, in writing, what you’ll never ask them to do, so they can recognise a fake straight away. Something like this:

That last line matters most. If your team think you’ll be irritated by a call, they won’t make it, and if they’re worried about being blamed, they won’t tell you when something’s gone wrong.

Send it now, and again before Christmas, when these scams pick up. Add it to your new starter pack too, so everyone who joins hears it from you.

How to prevent CEO fraud

A clear message from you does most of the work. These steps back it up:

• Agree a payment and gift card rule. Any new payee, any change of bank details, any gift card purchase and any urgent payment gets confirmed by phone, on a number you already hold. Our video on what to check before you pay new bank details covers the invoice side.
• Turn on impersonation protection in Microsoft 365. Microsoft Defender for Office 365, included in Microsoft 365 Business Premium, can flag or quarantine emails from outside your business that use the name of your directors. When a client tells us their MD’s name is being used, this is one of the first things we tighten.
• Flag external emails. A clear “this email came from outside your organisation” tag makes a Gmail address using your name stand out straight away.
• Give your team a proper way to report it. A report button that sends the email to your IT team means someone can check who else received it and block the sender.
• Include fake boss messages in your training. KnowBe4’s training library covers CEO fraud specifically, with phishing simulation emails that pretend to come from a senior person. Even before any training, around a quarter of staff at small organisations fell for a simulated phishing email in KnowBe4’s 2026 benchmarking report.

What to do if someone has already paid

If someone in your team does fall victim to CEO fraud, the first job is making sure they tell you quickly, without worrying about blame. It happens to careful people. The sooner you act, the better the chance of stopping the money:

• If it was a bank transfer, call your bank straight away. Banks can sometimes stop or recall a payment if they hear about it quickly.
• If it was gift cards, contact the gift card company immediately. Keep the receipts and any confirmation emails. If the codes haven’t been spent yet, they may be able to freeze them.
• Report it to Report Fraud and keep every email and message as evidence.
• Tell your IT team. They can check whether any accounts were compromised, check who else received it and block the sender. If the email came from your own domain rather than a Gmail address, our guide on how to tell if your email has been hacked explains what to look for.

How we help

At Ingenio, we look after businesses across Brighton, Sussex and the South East. When one of our clients’ staff reports a fake boss email, an engineer looks at it, checks who else received it and tightens the impersonation rules so the next one is quarantined before it reaches anyone.

Our KnowBe4 security awareness training gives your team short, regular lessons and simulated phishing emails, including fake boss scams, so the first one they see isn’t a real one. It’s part of our wider managed cyber security service.

Frequently asked questions

Final thought

CEO fraud relies on your team not wanting to bother you. Tell them you’ll never ask for gift cards or urgent payments by message, and that you’d always rather get a call than have them guess. That one message protects them and your business.

👉 Talk to us about protecting your team from fake boss scams. We’re happy to talk it through.

Sources

• GOV.UK: Cyber Security Breaches Survey 2025/2026 (April 2026)
• KnowBe4: 2026 Phishing by Industry Benchmarking Report
• KnowBe4: CEO fraud scammers are now bribing your users (January 2019, archived)
• KnowBe4: Real social engineering attack on KnowBe4 employee foiled (August 2024)
• NI Cyber Security Centre: Business email compromise