In this two-minute game show, Sally has to spot which of four emails is a scam, and two of them say they’re from Clive, the managing director. The scam is the fake boss scam: an email that pretends to be from someone senior and asks for £500 of gift cards within the hour, from an address that isn’t his and with an excuse not to take a call. If you’re ever unsure about a request like this, check another way: call the person on the number you already have.
What is the fake boss scam?
The fake boss scam, often called CEO fraud, is when a criminal pretends to be a director or senior member of staff to get someone to send money or buy gift cards. The NI Cyber Security Centre says the scammer uses a senior manager’s name so the email seems important, claims the task is urgent, says they can’t take a call, and often tries to get the person to buy gift cards or make a money transfer. Our guide to the fake boss scam walks through a real-world example.
Scam emails can look very convincing. The NCSC says many phishing messages do, and that they might pretend to be from someone you know or trust. Our guide to phishing, spear phishing and whaling explains how criminals research who to impersonate.
Why do scammers ask for gift cards?
Gift cards are easy for criminals to redeem and sell on. Action Fraud has explained that fraudsters don’t need the physical card to use its value: they persuade people to buy gift cards and then pass on the code on the back. So if Sally had bought the cards and sent the codes, the criminal could spend the company’s money.
Warning signs Sally spotted
- An address that isn’t his. The name said Clive, but the email address didn’t match his usual one. Look at the address, not just the name.
- A rush. “Within the hour” is there to stop you thinking it through.
- A request for gift cards. The NI Cyber Security Centre lists being asked to buy gift cards as a red flag.
- “I’m in meetings and can’t take calls.” An excuse that stops you checking with the person.
What to do about the fake boss scam
- Check another way. Call the person on a number you already have, never one from the email.
- Look at the sender’s email address, not just the name. A familiar name with an unfamiliar address is a reason to check.
- Agree a rule for gift cards and payments. The NI Cyber Security Centre suggests a policy to ignore any email that asks staff to buy gift cards, and more than one person to authorise payments.
- Report it. At work, press the report button if you have one, or tell your IT team. You can also forward scam emails to report@phishing.gov.uk.
Video transcript
Read the full transcript
Host: Welcome back to Who Wants to Be Cyber-Aware? The quiz where you win by spotting the scam.
Host: Sally, office manager, you’re one question away from the top. Which one of these is a scam? A: an email from Tom. “Cake in the kitchen!” B: from Clive, the MD. “Quick favour, urgent.” C: from Priya. “Meeting room at 2pm?” And D: also from Clive, the MD. “Team lunch on Friday.”
Sally: Two from Clive? Hmm. I’ll phone a friend.
Tom: Sally? Oh, er… I’m no expert, but check who really sent it. Look at the email address, not just the name. Good luck!
Sally: B’s from a different address. But that could be his personal email. Fifty-fifty, please.
Host: Let’s take away two wrong answers. Goodbye, A and C. Two left. B, “Quick favour, urgent”, and D, “Team lunch on Friday”. Both say they’re from your boss, Clive. Scammers often pretend to be someone important.
Sally: I’ll ask the audience.
Host: Audience, vote now! It’s a tie. Half say B, half say D. Scams can look very convincing.
Sally: Then I’ll read them properly. B says within the hour. That’s rushing me. It wants gift cards. He says he can’t take calls, so I’d need to check another way. And that’s not his address. It’s B.
Host: Is that your final answer?
Sally: Final answer.
Host: B is the right answer! That was the fake boss scam: a criminal pretending to be Clive, after gift card codes. If Sally had bought them, the criminal would only need the codes to spend the company’s money. So if you’re ever unsure, check another way. Call Clive on the number you already have.
Narrator: You don’t need to go on a game show to be cyber-aware. Just talk to Ingenio about managed cyber security. ingeniotech.co.uk.
Frequently asked questions
What is CEO fraud?
CEO fraud, or the fake boss scam, is when a criminal pretends to be a senior person in your business, often the managing director, and asks a colleague to send money, buy gift cards or share information. It’s a common form of business email compromise.
Why do scammers ask for gift cards?
The criminal only needs the code on the back to spend the value, and gift cards can be easily redeemed and sold on. Once the codes are sent, the criminal can use them.
My boss has emailed asking me to buy gift cards. What should I do?
Don’t buy them and don’t reply to the email. Call your boss on the number you already have to check. If it’s a scam, report it to your IT team.
How can I tell if an email from my boss is fake?
Look at the full email address, not just the name. Be wary of urgency, requests for gift cards or money, and any excuse not to take a call. If you’re unsure, check another way.
How can a business protect itself from the fake boss scam?
Agree a policy that staff ignore emails asking them to buy gift cards, have more than one person authorise payments, and train your team to check another way. A report button that sends suspicious emails to your IT team helps someone spot whether others received the same email.
Where do I report a scam email in the UK?
Forward it to report@phishing.gov.uk. It’s free. At work, use your report button if you have one, or tell your IT team.
How we help
At Ingenio, our managed cyber security service includes cyber security awareness training for your team, email spam filtering and management, and 24-hour security monitoring. Our KnowBe4 training sends your team simulated phishing emails, so they can practise spotting fake requests like this one. We’re based in Brighton and support businesses across Sussex and the South East.
Final thought
A familiar name on an email isn’t proof of who sent it. When a request involves money, gift cards or a rush, one phone call on a number you already have will tell you if it’s real.
👉 Talk to us about helping your team spot scam emails. We’re happy to talk it through.
