THREAT LIBRARY
EMAILTarget: EMPLOYEES — ESPECIALLY NEW ONES
“Are you at your desk? Quick favor.”
A short email from your “boss” who's in a meeting, can't talk, and urgently needs gift cards.
How it looks
FROM: Thomas Weber <t.weber.ceo@gmail-secure-mail.com>
SUBJECT: Quick favor
Are you at your desk? I'm heading into a board meeting and can't take calls. I need you to pick up 5x €100 Apple gift cards for a client appreciation — scratch the codes and email them to me. Keep this between us for now, it's a surprise. Will reimburse after. Sent from my iPhone
RECONSTRUCTION — NAMES, NUMBERS AND DOMAINS ARE INVENTED. THE PATTERN IS REAL.
Where the hook hides
Authority plus unavailability. The message carries your boss's name and a plausible errand, and the “in a meeting, can't talk” line removes the one thing that kills this scam instantly: a 20-second phone call to verify.
It targets the newest employees hardest — people who want to look responsive and don't yet know how the boss actually writes. Attackers pull names and org charts straight from LinkedIn.
Red flags — the three-second check
- 01The address isn't your company domain — a public or lookalike domain wearing a real name.
- 02Gift cards in any business context. There is no legitimate corporate errand paid in scratch codes.
- 03“Keep this between us” — secrecy has one function: preventing verification.
- 04Manufactured urgency plus unreachability, so the fastest path seems to be compliance.
- 05The ask arrived on a new channel. The boss who always messages on Slack suddenly emails? Verify.
Already hooked? Do this now
- 01Verify on a different channel — call or message the real person directly. Never reply to the email.
- 02If cards were bought: contact the issuer with receipts immediately; unredeemed codes can sometimes be frozen.
- 03Report to your IT/security team fast — you're almost never the only target in the company.
- 04If codes were sent, treat it as an incident, not an embarrassment. Speed beats shame.
Check your reflexes
Reading about it is not the same as catching it live. See whether this one would get past you.