Fraud Season: The Office Side of Returns and Gift Cards

The week after Christmas is famous for retail return fraud, but businesses get their own version. The gift card request that appears to come from the owner. The refund that should go "to a different card." The supplier who emails new bank details just in time for year-end payments.

These all work better this week than any other, because the office is thinly staffed and everyone is a little tired. A ten-minute briefing for whoever is holding the fort covers most of it.

Key takeaways

• The quiet week is prime time for payment fraud aimed at whoever is covering.

• Gift card requests from "the owner" are always verified by a phone call, no exceptions.

• Refund and bank-detail changes get confirmed through a number you already had.

• Temporary and covering staff need the rules too, perhaps most of all.

• A polite verification habit costs minutes; a successful fraud costs real money.

Step 1: Brief whoever is holding the fort

Whoever is covering this week, including you, gets the two-minute version: no gift cards ever, no payment changes without a phone call, no urgency from email alone. Say it out loud before the week starts.

Do not skip the senior people. Executives are the most-targeted and often the least-briefed, because nobody wants to tell the boss they might get fooled.

Step 2: The gift card rule has no exceptions

Any request to buy gift cards, from anyone, by any channel, gets verified by a voice call to a number you already know. This is the single most common fraud aimed at small businesses, and the quiet week is its favorite week.

Make it cultural rather than suspicious: "we always call, it's just the rule" is easier to enforce than judging each request on its merits. The merits are exactly what the attacker is good at faking.

Step 3: Verify changes through old contact details

The refund to a different card, the supplier's new bank account, the customer's changed email: every change of payment details gets confirmed through contact information you already had on file, never through the details in the message requesting the change.

This one habit defeats the entire category. Attackers can fake the request; they cannot fake your records.

Step 4: Make a no feel safe

The covering person's real fear is blocking something legitimate and getting blamed. Remove that fear now: tell them a false alarm is always fine and a checked request is never resented.

The person who feels safe saying "let me verify and call you back" is the whole control. Everything else is detail.

Frequently asked questions

What does the gift card scam actually look like?

A short message appearing to be from the owner or a senior person: "In a meeting, need gift cards for clients, can you grab some?" The tone is rushed and slightly secretive, on purpose.

Do small businesses really get targeted?

Constantly, precisely because controls are informal. The amounts are smaller than corporate fraud, but so is the buffer that absorbs them.

What if a real request gets delayed by verification?

Legitimate requests survive a phone call. Anyone who pushes back against verification is telling you something useful.

A practical next step

Give whoever is covering this week the two-minute briefing today, and make sure they know a false alarm is always welcome. If payment verification habits across your business need a proper look, book a Decision-Clarity Call.