The Original IT Company®

Sometimes It's OK to Say "NO" to the Boss!

December 06, 2018 IT Audit, Tech Tips

Gift card fraud scam preventionThe bad guys are getting creative with hybrid giftcard / CEO fraud scams. There is a massive campaign underway where fraudsters are impersonating an executive and urgently asking for gift cards to be bought for customers. The numbers need to be emailed or texted to the boss, after they are physically bought at stores.

Never comply with a request like this and always confirm using a live phone call to make sure it is not a scam. Sometimes it's OK to say "no" to the boss!

I've been hearing from South Florida clients whose staff got suckered into these scams. To show you how these scams work, see the actual email exchange below. 

Yep, that overzealous employee drove around town from store to store picking up iTunes gift cards for the bad guys because there was a limit on the number of cards that could be bought at any one store at one time.

All told, poor Emily bought TWENTY $100.00 iTunes gift cards for these criminals. Still worse, she put them ON HER OWN PERSONAL CREDIT CARD!

Wonder if her company will reimburse her? Kinda feel sorry for her. Sometimes it helps to get security awareness training from your organization. Emily was not trained. Don't be Emily.

Here is the email exchange in chronological order. Note the timestamps are the originals and from different time zones. Names are changed to protect the innocent. John Carpenter is the C-level executive of "distracted.com" and was spoofed by the bad guys.

From: John Carpenter <officeexec.mails@inbox.lv>
Sent: Thursday, September 6, 2018 11:20 AM
To: Emily Walker <ewalker@distracted.com>
Subject: Respond

Let me know when you are available. There is something I need you to do.
I am going into a meeting now with limited phone calls, so just reply my email.

John Carpenter

Sent from my iPad

-----------------------------
Subject: RE: Respond
Date: 6 September 2018 at 21:24:35
From: Emily Walker <ewalker@distracted.com>
To: John Carpenter <officeexec.mails@inbox.lv>

Did you intend to send this to me?

Emily Walker
Project Manager

Sent from my iPhone

-----------------------------
From: John Carpenter <officeexec.mails@inbox.lv>
Sent: Thursday, September 6, 2018 11:28 AM
To: Emily Walker <ewalker@distracted.com>
Subject: RE: Respond

Yes Emily, can you get this done ASAP? I need some couple of gift cards. 
There are some listed clients we are presenting the gift cards. How 
quickly can you arrange these gift cards because i need to send them 
out in less than an hour. I would provide you with the type of gift 
cards and amount of each.

 

Sent from my iPad
---------------------
Subject: RE: Respond
Date: 6 September 2018 at 21:48:03
From: Emily Walker <ewalker@distracted.com>
To: John Carpenter <officeexec.mails@inbox.lv>

Can do now. I’ll put on my credit card. Send me the following:

Type
Number
Amount

Emily Walker
Project Manager

 

Sent from my iPhone
-------------
From: John Carpenter <officeexec.mails@inbox.lv>
Sent: Thursday, September 6, 2018 11:52 AM
To: Emily Walker <ewalker@distracted.com>
Subject: RE: Respond


The type of card I need is Apple iTunes gift cards. $100 denomination, 
I need $100 X 20 cards. You might not be able to get all in one store, 
you can get them from different stores. When you get the cards, Scratch 
out the back to reveal the card codes, and email me the codes. How soon 
can you get that done? Its Urgent.

Sent from my iPad

--------------------------
Subject: RE: Respond
Date: 6 September 2018 at 21:55:17
From: Emily Walker <ewalker@distracted.com>
To: John Carpenter <officeexec.mails@inbox.lv>

I can do now. Do you want me to do online instead?

Emily Walker
Project Manager

 

Sent from my iPhone
-------------------------
On Sep 6, 2018, at 11:57 AM, John Carpenter <officeexec.mails@inbox.lv> wrote:

I need you get physical card from the store

Sent from my iPad

---------------------------
Subject: Re: Respond
Date: 6 September 2018 at 22:01:32
From: Emily Walker <ewalker@distracted.com>
To: John Carpenter <officeexec.mails@inbox.lv>
On my way to store now. What time need by?

Sent from my iPhone

---------------------
On Sep 6, 2018, at 12:05 PM, John Carpenter <officeexec.mails@inbox.lv> wrote:

As soon as you can. I will await codes

Sent from my iPad

-------------------------- 
Subject: Re: Respond
Date: 6 September 2018 at 22:13:37
From: Emily Walker <ewalker@distracted.com>
To: John Carpenter <officeexec.mails@inbox.lv>
If choice between the two do you want $15 or $25? 

Sent from my iPhone

---------------------
On Sep 6, 2018, at 12:16 PM, John Carpenter <officeexec.mails@inbox.lv> wrote:

$100

Sent from my iPad

----------------

Subject: Re: Respond

Date: 6 September 2018 at 22:51:58
From: Emily Walker <ewalker@distracted.com>
To: John Carpenter <officeexec.mails@inbox.lv>

 

Just texted you the first 11 codes. Heading to another store now. 5 and 6 limit per store.

Sent from my iPhone

------------------------
On Sep 6, 2018, at 12:54 PM, John Carpenter <officeexec.mails@inbox.lv> wrote:

Email the codes to me 

Sent from my iPad

---------- 

End of email thread. One hour and twenty five minutes later, the bad guys had $2000 in iTunes gift cards in their hands and Emily had charged all of them on her personal credit card. OUCH!

Remember to always confirm using a live phone call to make sure a request to purchase something, or send money, is not a scam.

Sometimes it is OK to say "no" to the boss!

Want to protect YOUR South Florida company and staff from malicious scams like the 'CEO Gift Card Scam' and other security threats? Contact our IT support services team for a complimentary consultation on how we can help protect your company!

Share This

Get The Latest Updates

Want the latest tech trends and tips to protect your business from Cybercrime?

SUBSCRIBE

Archives

see all

Facebook

LinkedIn