PanicStation.org
UK USA
us Work & employment crises

What to do if…
you receive an urgent message asking you to buy gift cards or make a payment for work

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Do not buy gift cards, send codes, approve a payment, or change payment details from the message alone. Verify the request using a known, separate contact method, then report it inside your workplace; if money or credentials were involved, contact the payment provider and use the FTC or FBI IC3 reporting route as appropriate.

Do not do these things

  • Don’t buy gift cards or send gift card numbers, PINs, photos, or receipts to anyone who asked in the message.
  • Don’t send a wire, ACH, Zelle, Venmo, Cash App, crypto, or “test payment” based only on a message.
  • Don’t approve a vendor bank-detail change from the same email, text, chat, or attachment.
  • Don’t click payment links or open unexpected invoice attachments from the message.
  • Don’t keep it secret because the message says it is confidential, urgent, or not to tell accounting.
  • Don’t continue the conversation in the same thread to confirm it; use a different channel you already trust.
  • Don’t delete the message yet, because your IT, security, finance, bank, or a reporting form may need details from it.

What to do now

  1. Pause the transaction immediately. If you are at a store checkout, step aside before paying. If you are in banking, payroll, expenses, or accounts payable software, stop before approving, sending, changing, or confirming anything.
  2. Verify the request outside the message.
    • Call the manager, executive, colleague, vendor, or finance contact using a number from your company directory, a saved contact you already had, or an in-person conversation.
    • Do not use a phone number, reply address, link, or contact detail supplied in the suspicious message.
    • If you cannot verify it quickly, treat it as unverified and do not proceed.
  3. Report it inside your workplace right away.
    • Forward the email to your IT, security, or helpdesk route if your workplace has one.
    • For texts, Teams, WhatsApp, Slack, or similar messages, send screenshots and the sender details to IT or security.
    • Tell finance, accounts payable, payroll, or the person who handles vendor records so they can watch for related invoice fraud, vendor bank-change requests, payroll diversion, or follow-up messages.
  4. If money was sent, act fast but do not assume recovery is guaranteed.
    • Contact the bank, card issuer, wire company, payment app, crypto platform, or other service used to send the money. Tell them it was a scam or fraudulent transaction and ask whether they can stop, reverse, recall, freeze, or dispute it.
    • For a bank wire or business transfer, ask your financial institution to contact the receiving financial institution as soon as possible.
    • If gift cards were involved, contact the gift card issuer right away. Tell them the card was used in a scam, ask whether the funds can be frozen or refunded, and keep the gift card and store receipt.
  5. File reports if this involved a scam, work payment, impersonation, vendor change, or compromised work email.
    • Use the FTC’s ReportFraud site for a scam report.
    • Use the FBI’s IC3 complaint form for business email compromise, work-payment fraud, leadership impersonation, vendor-payment diversion, or cyber-enabled fraud.
  6. Preserve the evidence. Save the message, full email headers if available, sender address or phone number, usernames, requested amounts, payment instructions, links, attachments, receipts, card details, bank details, and the times you acted.
  7. If you shared a password, login code, bank details, payroll details, or payment credentials, contain it quickly. Tell IT or security exactly what was shared, even if you are not sure it was used, and follow their steps for account locking, password resets, and monitoring.

What can wait

  • You do not need to decide right now whether to confront the sender or accuse anyone.
  • You do not need to prove the whole scam yourself before stopping the payment.
  • You do not need to complete a perfect report before calling the bank, payment provider, gift card issuer, or workplace security route.
  • Workplace policy reviews, training, disciplinary questions, and long-term security changes can wait until the immediate payment and account risk is contained.

Important reassurance

These messages are designed to imitate normal workplace urgency, authority, and confidentiality. Slowing down, verifying through a separate trusted channel, and involving finance or IT is the safest response, even if the request later turns out to be legitimate.

Scope note

These are first steps only to prevent immediate loss, protect workplace accounts, and preserve the information needed for reporting. Later decisions about employment, insurance, legal claims, incident response, or recovery may need specialist help.

Important note

This guide is general information, not legal, financial, technical, cybersecurity, or professional advice. Options and outcomes vary by employer, bank, payment method, gift card issuer, platform rules, timing, and the facts of what happened.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us