Cybersecurity, Gift Card Scams

Requests via email, text, or phone instructing you to purchase or send gift cards are highly likely to be scams, even if they look like they come from someone you know. Follow these guidelines to protect yourself and report suspicious activity.

Recognizing Gift Card Scams

• Scammers often pose as university faculty, staff, or other VIPs (e.g., the Chancellor or Provost) to create a sense of urgency and legitimacy.

• Initial messages may be vague, such as, "Are you available? I need your assistance urgently."

• They will typically request that you purchase gift cards and either share the card numbers or send the cards somewhere.

What to Do

1. Be cautious: Stay alert to unusual or suspicious requests.

2. Verify the sender: Check the sender’s email address. Hover over or right-click the name in the "From:" line to confirm its legitimacy.

3. Report the attempt: Report suspicious emails or scams to the Cybersecurity Operations Center either by utilizing the Report Spam Outlook Add-in or forwarding the email to security@illinois.edu.

What Not to Do

• Do not reply: Cease communication immediately.

• Do not purchase anything: Legitimate university expenses are processed through established purchasing channels with proper approvals.

• Do not trust unofficial communication: Scammers often impersonate VIPs to pressure you into acting quickly.

• Do not forward suspicious emails to your coworkers, departmental IT staff, or other individuals. Forwarding these messages can cause unnecessary confusion and may even expose others to malicious links or attachments.

Key Points to Remember

• Requests to buy gift cards outside official channels are highly unusual and improper.

• Gift card or cash advance purchases are prohibited on university P-Cards. Refer to the University Purchasing Card (PCard) - Prohibited Purchases page for more details.

• If a request seems rushed, out of place, or otherwise suspicious, stop and question it.

If You Responded to a Scam

If you replied to a scam email but have not purchased gift cards or sent any sensitive information, there’s likely no harm done. However, you should still report the incident to security@illinois.edu.