Last week, I bought $400 in Amazon gift cards because I was fooled by an elaborate internet con called the "boss scam". Here's how the scam works, and why almost anyone – even an entrepreneur who doesn't have a boss, or a technology writer like me – can get sucked in.

The basic premise of the boss scam is to send a request to someone, ostensibly from their boss, asking them to purchase gift cards as a surprise for valued employees.

The scammer then obtains the gift card numbers and uses the cards and the person who bought them learns a humiliating and expensive lesson. In my case it didn't get quite that far – but it was still infuriating and deeply embarrassing.

Here's how it happened. I applied to join the board of a local nonprofit. Last Friday, I got an email from the group's president, or so I thought. [I'll call him Pete, which is not his real name, but is the name of my first boss.] I use Gmail, which shows the sender's image, if there is one and their name in bold letters.

The email address is there too, in smaller type. I saw Pete's image and his name. The subject line referenced his nonprofit. I assumed the message was really from him. 

That was the entire email and nothing about it made me think this might be a hoax. So I answered with an equally brief message to say that I was available. 

Hi Minda, I have been working on incentives and I aim to surprise some of our staff with gift cards and I will like you to handle this for me. You will keep it secret from others until I reveal the beneficiaries. I will get back to you with full details. Let me know if you can take care of this for me.

Regards, Pete

At the mention of gift cards, I should have suspected something was up. But it was the middle of a busy Friday afternoon.

I was hurrying to finish some work because my husband and I had plans that evening. Also, the real Pete had told me this was a working board and that he would ask board members to handle various tasks for the organization.

I decided he must be testing my willingness to do administrative work. I wrote back quickly to say that I didn't know the staff yet and wouldn't know what they'd like but was willing to help him as needed.

Okay Minda, Here is what I need you to do, Kindly make the purchase of 4 Amazon gift cards at a denomination of $100 each, amounting to $400 from any nearby store or gas station. Get back to me with the picture of the receipt once you have them. Let me know how soon you can get them and how you would prefer to be reimbursed.

Regards, Pete

I think it was clever of the scammer to end the message with the question about how to reimburse me. It immediately got me thinking about how he should send me back the money and kept me from focusing on how odd the whole thing was.

Still rushing to meet a deadline, I quickly looked on Amazon, found I could have the cards delivered the same day, and bought them.

When they arrived, I figured the simplest thing to do would be to forward Amazon's purchase confirmation to Pete and I did – but because I was forwarding the message rather than responding in the thread, I sent it to the real Pete's email address.

That's was when I finally started thinking about what I was doing. I noticed the image that came up with Pete's real address was a different photo from the one in the earlier emails I'd received.

The scammer, having never gotten an email from Pete, couldn't know what image he used on his email, I'm assuming. And Pete is a local entrepreneur whose image is widely available online, along with the name of the nonprofit.

Having noticed the inconsistent images, I at last took a look at the email address on the messages asking me to buy the gift cards. It turned out to be This email address is being protected from spambots. You need JavaScript enabled to view it.. My first--unbelievably stupid – thought was that this might be Pete's personal email, which he was using to keep the gifts secret and perhaps by using his proper email I had spoiled the surprise.

I even started writing an email to warn him that I'd forwarded Amazon's email to his official address. But I didn't finish that message because the truth had begun to penetrate my brain.

I abandoned my half-written email and did a quick search, first for that strange email address, which turned up no results, and then for "scam involving Amazon gift cards." And there it was, a warning from the Federal Trade Commission describing exactly the email conversation I was having with Fake Pete.

I quickly got on the phone with Amazon and was told that 1) even if I had forwarded my order confirmation to Fake Pete, that would not be enough for the scammer to get access to the gift cards; and 2) gift cards are non-returnable, so I was stuck with them.

Fortunately, we buy lots of things on Amazon, particularly around the holidays, so we can use those cards or give them as gifts.

"I need you to remove the cards from the pack."

I got further confirmation that the scammer couldn't use the cards when he started texting me, having gotten my number from my email signature. 

Hi Minda, did you receive my email? Can you send the receipts here? – Pete

I decided to string the scammer along a little. "I'm not sure how to forward to a text."

Okay. Can you take pictures of the cards and send them to me?

"You don't believe me that I have them?"

I'm sorry. I just needed to be sure. And I will like to have details of the cards before sending them out. I need you to remove the cards from the pack, scratch the silver panel at the back of each card and send me the photos of each card.

Apparently the scammer had decided to stop babying me along and come right out and ask for what they needed. I responded: "As I said, you can trust that I have them. If we're giving them as gifts, I shouldn't open them, it seems to me."

I was curious to see how the scammer would try to convince me that opening the cards was the right thing to do, but I guess they realized the scam wasn't working, because I never received another message from Fake Pete.

I wish I could tell you that this was the end of the story, but it wasn't quite. Later that evening, the real Pete – who had seen my email forwarding the Amazon order – interrupted a date with his wife to call me and make sure I knew that the gift card request was a scam.

The same email had gone out to many of his contacts at the nonprofit, though most had recognized that it was fraud faster than I had.

I assured him that I'd figured it out before giving the scammer any money and apologized for interrupting his date. I hung up wondering if he now thought I was too big an idiot to serve on his board.

This is what makes the boss scam so powerful. The messages supposedly come from someone you really want to please and impress – a customer, an investor, a trusted colleague or even an actual boss. It plays on our human desire for success and happiness and for connection. That's a strong motivator – and one that can too easily be turned against us.

 

Inc