PanicStation.org
UK USA
uk Work & employment crises

What to do if…
you receive an urgent message asking you to buy gift cards or make a payment for work

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Pause and do not pay, buy gift cards, or share codes. Verify the request using a known, separate contact method, then report it internally as a suspected scam.

Do not do these things

  • Don’t buy gift cards “just to get it done”, even if the message says you will be reimbursed.
  • Don’t share gift card codes, photos of card backs, screenshots, receipts, invoice details, or payment confirmations with the sender.
  • Don’t click payment links, invoice links, file-sharing links, or “confirm bank details” links from the message.
  • Don’t reply in the same suspicious email, text, Teams, WhatsApp, or chat thread to check if it is genuine.
  • Don’t let secrecy or urgency override normal payment checks.
  • Don’t delete the message yet; your IT, security, finance, or manager may need it.

What to do now

  1. Stop the transaction. If you are at a till, checkout page, gift card display, banking app, or payment screen, pause and do nothing further.
  2. Move out of the scammer’s channel. Do not continue the conversation in the same thread, chat, or number that made the request.
  3. Verify with a trusted route you choose. Call your manager, colleague, finance contact, or supplier contact using a number from your company directory, a saved contact you already trust, or an in-person check. Do not use a number or link from the suspicious message.
  4. Treat silence as a no. If you cannot verify the request quickly, do not pay, buy gift cards, approve an invoice, change bank details, or send codes.
  5. Report it inside your workplace. Send the suspicious email or a screenshot of the text, Teams message, WhatsApp message, invoice request, payment link, or bank-detail change request to your IT, security, finance, accounts payable, or helpdesk route.
  6. Warn the payment owner. Tell the person or team who normally approves payments, expenses, gift cards, supplier changes, or payroll changes so they can check for linked attempts.
  7. If it came by email, report it as phishing. Forward the suspicious email to report@phishing.gov.uk. This route is for suspicious emails, not for reporting a crime.
  8. If it came by SMS, report it to your mobile provider. Forward the suspicious text to 7726 if your provider supports it. This is usually free.
  9. If you already paid, bought gift cards, or shared codes, act quickly.
    • Contact your bank or payment provider immediately and ask what options are available to stop, recall, dispute, or recover the payment if possible.
    • If gift cards are involved, contact the gift card issuer or retailer immediately and ask whether any remaining balance can be blocked or frozen. Keep the cards and receipts.
    • Tell your employer’s finance, IT, security, or manager immediately so they can check whether other staff, supplier accounts, invoices, or payroll details are being targeted.
  10. If money was lost, report the fraud.
  • If you are in England, Wales or Northern Ireland, report fraud or cyber crime to Report Fraud.
  • If you are in Scotland, report fraud to Police Scotland by calling 101.
  1. Save a simple record. Keep the message, sender details, time and date, amount requested, payment details, gift card brand, card numbers if already shared, receipts, and any case or reference numbers.

What can wait

  • You do not need to decide now whether to confront the sender, accuse anyone, or prove exactly how the scam happened.
  • You do not need to complete a perfect incident report before alerting the right internal team.
  • You do not need to decide reimbursement, complaint, disciplinary, insurance, or policy issues in this first moment.
  • You do not need to do a full device reset unless your IT or security team tells you to.

Important reassurance

These scams are designed to copy authority, urgency, secrecy, and helpfulness at work. A believable message does not mean you were careless; slowing down, verifying separately, and reporting quickly is the right response.

Scope note

These are first steps to prevent immediate loss and contain workplace risk. Later decisions about internal investigation, reimbursement, complaints, passwords, supplier checks, or formal reporting may need help from your employer, bank, payment provider, card issuer, insurer, union, adviser, or another specialist.

Important note

This guide provides general information and first-step actions only. It is not legal, financial, cybersecurity, employment, therapeutic, or professional advice.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us