--- title: "The Newest Business Email Compromise Request: Gift Cards | DuoCircle" description: "The purpose of Business Email Compromise (BEC), a type of phishing attack." image: "https://www.duocircle.com/images/og-default.png" canonical: "https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/" --- Quick Answer Business email compromise has shifted from wire transfer fraud to gift card requests. The APWG Phishing Activity Trends Report found gift cards were the requested payout in 65 percent of BEC attacks, because they're more anonymous than wires, harder to reverse, and don't require an intermediary mule account. The dollar per incident is lower than a wire BEC, but volume more than makes up for it. Most-requested cards: Google Play (41 percent), Steam Wallet (12 percent), Amazon (9 percent), Apple iTunes (8 percent). The standard pretext is an executive-impersonation email asking the recipient to buy cards urgently, scratch off the codes, and email the digits back. Defenses: written purchase policies that include gift cards in the same out-of-band verification rule as wire transfers, plus cloud email security with link click protection and impersonation detection at the gateway. Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=The%20Newest%20Business%20Email%20Compromise%20Request%3A%20Gift%20Cards&url=undefined%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F&title=The%20Newest%20Business%20Email%20Compromise%20Request%3A%20Gift%20Cards "Share on Reddit") [ ](mailto:?subject=The%20Newest%20Business%20Email%20Compromise%20Request%3A%20Gift%20Cards&body=Check out this article: undefined%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F "Share via Email") ![Business Email](https://media.mailhop.org/duocircle/images/2019/09/SMTP-relay-3758.jpg) The purpose of [Business Email Compromise](https://www.fbi.gov/news/stories/business-e-mail-compromise-on-the-rise) (BEC), a type of **phishing attack**, is to target employees with access to company finances and trick them into sending money to the hacker. In the past this almost always meant a wire transfer. From the hackers standpoint, there are two problems with wire transfers. First, they’re hard to keep **anonymous**. The hacker has to send some information about where to transfer the money. Second, companies are getting wise to this and changing policies to ensure all wire transfer requests are verified through a second channel. [![Phishing Activity Trends Report](https://media.mailhop.org/duocircle/images/2019/09/sender-policy-framework-4632.jpg)](https://media.mailhop.org/duocircle/images/2019/09/sender-policy-framework-4632.jpg) _As companies wise up, hackers change their tactics_. Now, according to the latest [Phishing Activity Trends Report](https://docs.apwg.org/reports/apwg%5Ftrends%5Freport%5Fq2%5F2019.pdf), _the newest version of BEC seeks payment in the form of gift cards_. According to the report, “Gift cards were requested in **65% of business email compromise** (BEC) attacks.” The report continued, “because they are more anonymous, less reversible, and do not require the use of a mule intermediary, _gift cards have quickly emerged as the most popular cash out option for scammers over the past year_.” The good news, if there is any, is that “the amount of money that an attacker can make in each gift card BEC attack is significantly less than with a [wire transfer](https://www.symantec.com/blogs/threat-intelligence/bec-scams-trends-and-themes-2019).” Which gift cards were the most requested? “By far, the most common gift card requested by BEC scammers was for Google Play, Google’s online app store (41%). That was followed by gaming site Steam Wallet (12%), Amazon (9%), and Apple iTunes with (8%).” _If someone sends you an email requesting that you buy them a gift card, you now know there’s a good chance it’s a scam_. It’s especially worrisome if they tell you to buy the card, scratch off the back and email them the 16 digits. [![email security service](https://media.mailhop.org/duocircle/images/2019/09/spf-record-tester-4321.jpg)](https://media.mailhop.org/duocircle/images/2019/09/spf-record-tester-4321.jpg) There’s no doubt companies will respond by amending their purchase policies to include gift cards, eventually. In the meantime, another way to protect your company against BEC is with cloud-based [email security service](/) with real-time **link click protection**. You can set up our service in 10 minutes, comes with 24/7 live customer support and costs much, much less than a gift card. ![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) Brad Slavin General Manager General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio. ## Secure your email infrastructure Protect, authenticate, and deliver. Contact our team to find the right solution. [Contact Sales](/contact/) [Explore Products](/products/) Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F) [ ](https://twitter.com/intent/tweet?text=The%20Newest%20Business%20Email%20Compromise%20Request%3A%20Gift%20Cards&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Femail-security%2Fthe-newest-business-email-compromise-request-gift-cards%2F) Copy Related Articles - [ BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does Email Security ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/) - [ ![Designing A Custom Dkim Architecture For High-Volume Email Senders](https://media.mailhop.org/duocircle/images/2026/04/buy-smtp-1290.jpg) Designing A Custom Dkim Architecture For High-Volume Email Senders Email Security ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/) - [ ![DMARC, SPF, and DKIM](https://media.mailhop.org/duocircle/images/2026/04/spf-record-4526.jpg) DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Email Security ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/) - [ ![Email Monitoring Tools](https://media.mailhop.org/duocircle/images/2026/05/spf-validator-6720.jpg) Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem Email Security ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/) ## Related Articles [ Email Security 8m BIMI in 2026: What the Certificate Authority Does, and What Your DMARC Tool Does May 5, 2026 ](/blog/bimi-2026-what-the-ca-does-what-your-dmarc-tool-does/)[ Email Security 8m Designing A Custom Dkim Architecture For High-Volume Email Senders Apr 28, 2026 ](/blog/designing-custom-dkim-architecture-for-high-volume-email-senders/)[ Email Security 12m DMARC, SPF, and DKIM in 2026: Why Email Authentication Is Now a Regulatory Requirement, Not Just a Best Practice Apr 29, 2026 ](/blog/dmarc-spf-dkim-2026-email-authentication-regulatory-requirement-best-practice/)[ Email Security 5m Email Monitoring Tools: A Complete Guide to Protecting Your Email Ecosystem May 7, 2026 ](/blog/email-monitoring-tools-guide-protecting-your-email-ecosystem-security/) ```json {"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}} ``` ```json [{"@context":"https://schema.org","@type":"BlogPosting","headline":"The Newest Business Email Compromise Request: Gift Cards","description":"The purpose of Business Email Compromise (BEC), a type of phishing attack.","url":"https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/","datePublished":"2019-09-25T17:35:20.000Z","dateModified":"2025-05-23T11:33:43.000Z","dateCreated":"2019-09-25T17:35:20.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/"},"articleSection":"email-security","keywords":"","wordCount":358,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/09/SMTP-relay-3758.jpg","caption":"Business Email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"Email Security"},{"@type":"ListItem","position":3,"name":"The Newest Business Email Compromise Request: Gift Cards","item":"https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/"}]}] ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"Email Security","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"The Newest Business Email Compromise Request: Gift Cards","item":"https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/"}]} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"The Newest Business Email Compromise Request: Gift Cards","description":"The purpose of Business Email Compromise (BEC), a type of phishing attack.","url":"https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/","datePublished":"2019-09-25T17:35:20.000Z","dateModified":"2025-05-23T11:33:43.000Z","dateCreated":"2019-09-25T17:35:20.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/email-security/the-newest-business-email-compromise-request-gift-cards/"},"articleSection":"email-security","keywords":"","wordCount":358,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2019/09/SMTP-relay-3758.jpg","caption":"Business Email","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ```