Confidential Gift Card Demand by Executive — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated May 28, 2026

Severity: HIGH | View Full Scam Details

Confidential Gift Card Demand by Executive Scam in India 2026: WhatsApp Phishing Alert

This rising cybercrime in India uses fake WhatsApp messages from “executives” to trick employees into buying confidential gift cards, leading to significant financial loss.

What Is the Confidential Gift Card Demand by Executive?

The Confidential Gift Card Demand scam is a sophisticated phishing fraud targeting employees in Indian companies. Fraudsters impersonate high-ranking officials, such as CEOs or CFOs, via spoofed or hijacked WhatsApp accounts. Using publicly available info from sources like LinkedIn or company websites, they identify mid-level employees who might handle purchases or finance duties.

Once connected, the scammer sends urgent WhatsApp messages requesting confidential gift cards — often suggesting these are for "important company use" or "internal rewards." Because the request appears to come from a trusted boss or senior executive and includes company-related language and branding, victims are misled into believing the demand is legitimate.

According to public complaints reported to cybercrime authorities and advisories from CERT-In and I4C, this scam has become increasingly common in Indian IT and corporate sectors during 2025-26. The Reserve Bank of India (RBI) has flagged gift card and prepaid voucher fraud as an emerging risk vector, especially due to their wide acceptance and untraceable nature once redeemed.

How This Scam Works — Step by Step

1. Reconnaissance Phase: Fraudsters research an organization’s staff hierarchy using LinkedIn and company websites to find employees who regularly handle procurement or finance.

2. Contact Initiation: They spoof or hijack WhatsApp numbers resembling those of top executives (e.g., CEO or CFO). This often involves a phone number very similar to the real one, causing confusion.

3. Urgent WhatsApp Message: The scammer sends a message from the fake number, often starting with a friendly tone such as “Hi, can you arrange this urgently?” or “Confidential request from the leadership team.”

4. Request for Gift Cards: The scammer demands the immediate purchase of specific gift cards (Amazon, Flipkart, or other popular Indian retailers’ e-vouchers) with an emphasis on secrecy and speed, sometimes warning against discussing this with colleagues.

5. Payment and Sharing Codes: Victims buy the requested gift cards and share the confidential voucher codes or card details through WhatsApp messages.

6. Financial Loss: The fraudsters instantly redeem these gift cards or convert them to cash using illegal resale platforms, often untraceable. The victim’s company bears the cost, and sometimes the employee is pressured to reimburse the amount.

This scam’s reliance on impersonation, urgency, and gift-card payments makes it very effective. The use of WhatsApp, a trusted communication tool in India, adds to victims’ vulnerability.

Real Warning Signs to Watch For

• Urgent messages demanding immediate purchase of gift cards without official purchase orders.
• Requests insisting on secrecy or no sharing with other colleagues or finance departments.
• WhatsApp numbers that slightly differ from the real executive’s registered contact (e.g., 98XXXXXX12 vs 98XXXXXX13).
• Generic greetings like “Dear employee” rather than personalised names or official email signatures.
• Unusual or off-hours requests for high-value gift cards.
• No formal company approval documentation or emails accompanying the request.
• Pressure tactics like threats of negative consequences for non-compliance.

What Happens to Victims

Victims, often unaware until it’s too late, face financial and emotional distress. Companies lose considerable sums in INR due to unauthorized gift card spending. Employees may also suffer professionally if their superiors question their financial diligence.

Recovering losses through UPI transactions linked to these scams is difficult, as prepaid gift cards generate instant, irreversible value transfer. Some victims report SIM swap attacks following these scams, leading to further fraud involving their Aadhaar-linked mobile numbers.

The psychological toll can be severe, with embarrassment and fear of reprisal causing delayed reporting to authorities.

What RBI and CERT-In Say

The Reserve Bank of India and CERT-In (Indian Computer Emergency Response Team) have issued broad advisories warning against phishing impersonation scams exploiting WhatsApp and prepaid instruments. RBI points out that gift cards, e-wallets, and prepaid payment instruments have an inherent fraud risk if misused.

CERT-In urges victims to be vigilant about unsolicited requests over messaging apps and to verify identity through alternate channels before proceeding with any payment requests. The 1930 cybercrime helpline operated by govt of India is a dedicated resource for reporting such offences and seeking assistance.

General guidelines emphasize not sharing confidential company data or payment credentials on WhatsApp or similar platforms and using official corporate communication tools for sensitive requests.

How to Protect Yourself

1. Verify Identity: Always confirm unusual payment requests via alternative official channels such as direct phone calls to the executive’s known number or internal corporate email.

2. Scrutinize WhatsApp Numbers: Check the sender’s WhatsApp number carefully for slight discrepancies before responding.

3. Follow Company Protocol: Never process gift card or voucher purchases without an official purchase order and approval from multiple hierarchy levels.

4. Avoid Urgency Pressure: Treat any request insisting on secrecy or immediate payment as suspicious and escalate to your company’s IT or security team.

5. Use WhatsApp Business Features: If your company uses WhatsApp Business, verify business profiles for authenticity.

6. Educate Your Team: Conduct regular awareness sessions around social engineering and phishing risks specific to WhatsApp and payment instruments.

7. Report Suspicious Contacts: Immediately report to your IT department and block the suspect WhatsApp numbers.

What to Do If You've Been Targeted

• Do Not Panic: Stop all communication with the suspected scammer.
• Report to IT: Inform your company’s cybersecurity or IT department immediately.
• Freeze Payments: If you have shared gift card codes, try to halt card redemptions through retailer helpdesk if possible.
• Contact Cybercrime Authorities: File a complaint at cybercrime.gov.in or call the 1930 national cybercrime helpline.
• Alert Your Bank: Notify your bank or payment service provider to monitor any irregular transactions or UPI activities linked to your accounts or phone number.
• Preserve Evidence: Keep all WhatsApp chats, screenshots, and transaction records to aid investigation.
• Change Passwords: Update passwords for relevant corporate and personal accounts, especially those linked to WhatsApp.

Frequently Asked Questions

Q: Can gift cards really be a part of a scam?

Yes. Fraudsters prefer gift cards because once the code is shared, the money is instantly spent or resold, making recovery very difficult compared to bank transfers or digital wallets.

Q: How can I recognize if a WhatsApp message is spoofed or fake?

Look for slight changes in the sender’s phone number that mimic your boss’s real contact, unusual requests that violate company policy, or pressure to keep the transaction secret.

Q: What should I do if I’ve accidentally shared gift card details?

Immediately contact your company’s finance department and the retailer issuing the card. File a complaint on cybercrime.gov.in and call the 1930 helpline for guidance on next steps.

For anyone unsure about suspicious WhatsApp messages or requests related to gift cards, visit BharatSecure.app to verify and learn how to protect yourself. If you encounter any suspected fraud, report it promptly via the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.