How to Recognise Gift Card Payment Scams Targeting Australian Businesses

Summary

This guide helps you troubleshoot and resolve: How to Recognise Gift Card Payment Scams Targeting Australian Businesses. Follow the steps below to fix the issue.

Common Causes

Gift card scams are a growing threat to Australian small businesses. Fraudsters often impersonate company executives, trusted suppliers, or government agencies to trick employees into purchasing gift cards and sharing the codes. Because gift cards are untraceable and difficult to recover, prevention is the only effective defence.

How Gift Card Scams Work

These scams typically begin with an email, SMS, or phone call. The sender claims to be a senior manager or a regular vendor and urgently requests that you buy gift cards—such as Google Play, Apple, or Amazon cards—to cover a "confidential expense" or "client reward." They will then ask you to photograph the codes or read them over the phone.

Quick Warning Signs

• Urgent requests to buy gift cards via email, SMS, or phone
• Messages from executives using personal email addresses instead of company domains
• Requests to keep the transaction secret or "off the books"
• Demands for gift card codes, photos of cards, or PIN numbers
• Poor grammar, unusual tone, or mismatched sender details

Steps to Verify a Suspicious Request

1. Do not reply to the suspicious message or call the number provided in it.
2. Contact the supposed sender directly using a known phone number or internal directory.
3. Check the email address carefully. Look for misspelled domains or public addresses like @gmail.com or @outlook.com.
4. Speak to another manager or business owner before making any purchase.
5. Never share gift card codes, photos, or PINs with anyone via email, SMS, or phone.

Detailed Instructions: Inspecting Suspicious Emails

Microsoft Outlook (Desktop)

1. Open Outlook and select the suspicious email.
2. Hover your mouse over the sender's name to reveal the full email address.
3. Right-click the message and select View Message Source to inspect headers.
4. If the address looks suspicious, select the email and click Report Message > Phishing in the ribbon.

Microsoft Outlook (Web)

1. Sign in to Outlook on the web.
2. Open the suspicious message.
3. Click the More actions (three dots) button in the top-right corner of the message.
4. Select Report > Report phishing.

Gmail

1. Open Gmail and select the suspicious email.
2. Click the More (three vertical dots) icon next to the Reply button.
3. Select Report phishing.

Apple Mail

1. Open Apple Mail and select the message.
2. Click the Forward as Attachment icon or select Message > Forward as Attachment from the menu bar.
3. Send the attachment to your IT provider for analysis.

What to Do If You Have Already Purchased Gift Cards

1. Stop all communication with the scammer immediately.
2. Contact the gift card retailer and report the fraud. Provide receipts and card details if available.
3. Report the incident to ReportCyber via the Australian Cyber Security Centre website.
4. Report the scam to Scamwatch via the ACCC website.
5. If you have suffered financial loss, report the incident to your local police.
6. Inform your staff so others do not fall for the same request.
7. Open a Ticket with 220 Internet Services so we can review your email security and help block similar messages.

Tip: Establish a clear payment policy that prohibits gift card purchases unless approved by two authorised signatories. Require all supplier changes to be verified by phone using a previously known number.

Warning: Legitimate Australian businesses and government agencies will never request payment via gift cards. Any such request should be treated as a scam.

Still Having Issues?