Avoid gift card scams
Gift card scams are incredibly upsetting and stressful for the person who has fallen victim to the scam. The scams often start with highly targeted ‘spear-phishing.’
At a glance
Take a few minutes and think about any potential gift card requests. Senior staff and teaching staff should make it clear that they will never ask for these.
Never give away any sensitive personal information like a National Insurance (NI) Number (social security number) or driver’s license number.
Know that government authorities will never ask for payment by gift cards and always contact the authorities immediately if you believe you’ve fallen victim to a scam.
Mark the email as junk by right-clicking the email.
Do not click on any links within the body of the email. Avoid replying to the email.
Stay vigilant
The University is a prime target for gift card scams. Most people don’t fall for these attacks, but it only takes a handful to have a significant impact.
Here’s what to do to avoid and react to phishing attacks at Oxford:
Do
- Use the University mail filtering for spam
- Take a few minutes and think about any potential gift card requests. Does the email look like it has come from a senior member of staff?
- Report phishing attempts targeting University credentials to phishing@infosec.ox.ac.uk. Make sure to include the original phishing email as an attachment, with confirmation of whether you have divulged your credentials or downloaded any attachments
- Report other phishing emails to the target institution
- Delete phishing emails after reporting.
Don't
- Avoid buying a gift card. Senior staff and teaching staff should make it clear that they will never ask for you to buy gift cards for a specific event. If you are still unsure, contact the member of staff whom the email purports to be from through another channel, i.e., Teams, by phone or a separate email, this time using the email from the University's internal directory
- Reply
- Click on any links within the body of the email
- Report all spam and phishing attacks against other organisations (e.g. banks) to us – unfortunately, we can’t help in those situations
- Keep it to yourself. Warn colleagues when you notice new phishing attacks. The university fosters a no-blame culture, and we would like you to report early so we act quickly to keep you safe.
How does a gift card scam work?
In this type of scam, the scammers have done some homework on your organisation; their mail to you often looks like it has come from a colleague or superior in your department or college.
The supposed requestor is always indisposed, maybe in a conference, a meeting or rushing to an event. To make the pretend event successful, they implore you to acquire some gift cards from a nearby shop, scratch off the panel on the back and send this unique number to them by reply. You will be promised your money back with a departmental claim.
These gift cards or vouchers are typically untethered to individual identities, hard to trace, easy to convert to cash or resalable goods. They are not bound by the same extensive regulations as credit and debit card transactions. It’s no wonder so many different scams have developed around gift cards.