Thanksgiving week brings unfinished work, shorter schedules, and an inbox full of holiday deals. Black Friday (Nov. 27) and Cyber Monday (Nov. 30) add to the noise. It’s a busy time of year, and scammers know it.
The “quick favor”
Here’s a message we see every year, in many versions:
“Hi, are you available? I’m in back-to-back meetings and can’t talk, but I need a quick favor. I want to surprise the team with gift cards for Thanksgiving. Can you pick up a few and send me photos of the codes? I’ll reimburse you. Please keep it quiet for now!”
Red flags to watch for
- Urgency and secrecy. You’re being asked to act quickly and keep the request quiet.
- Unfamiliar contact information. The message comes from a personal email address or an unfamiliar phone number.
- A request for gift-card codes. Someone wants photos of the numbers or codes on the cards.
The message may appear to come from your chair, dean, or a VP. The name is familiar, the request sounds plausible, and you want to help. That’s exactly what makes this scam effective.
What makes the request convincing
You don’t have to be careless to fall for this. The scam takes a normal instinct—helping a colleague—and uses urgency to discourage you from checking first.
A few things are worth remembering:
- Gift cards are like cash. Once you share the codes, the money is usually gone and may be difficult or impossible to recover.
- The details may look real because they often are. Names, titles, and reporting lines are easy to find on public department pages and professional profiles.
- Good grammar isn’t proof. A polished message can still be a scam. Spelling mistakes and awkward wording aren’t reliable tests of authenticity, either.
Cybersecurity isn’t about expecting everyone to recognize every scam. It’s about developing the habit of checking when something doesn’t feel right—and making it easy to ask for help.
Verify before you buy
Remember one rule: if it’s urgent, it’s worth a call.
- Check with the person another way. Call them, message them on Teams, or walk down the hall. Use contact information you already have, not the number or address in the suspicious message.
- Treat gift-card requests as a reason to stop and verify. An email or text asking you to buy gift cards is not a reason to head to the store. Confirm the request independently before spending any money or sharing any codes.
- Report it, even if you’ve already acted. Use the Report Phishing button in Outlook, or forward the message to abuse@chapman.edu. If you’ve already bought cards or shared the codes, contact Information Security immediately at infosec@chapman.edu. Don’t wait because you’re embarrassed or unsure. Reporting quickly gives us a better chance to help.
The same rules apply to holiday shopping
The same tactics show up in holiday shopping, at work, and at home. The details may change, but the habit that protects you is the same: pause, verify, and then act.
Here are three ways to put that into practice:
- Don’t tap “missed delivery” links. Fake shipping texts and emails are common holiday lures. If you’re expecting a package, open the carrier’s app or type its website address yourself.
- Go directly to the retailer’s website. A convincing ad isn’t proof that a seller is legitimate. Rather than relying on a link in an email or message, find the retailer yourself.
- Keep work and personal accounts separate. Avoid using your Chapman email for personal shopping accounts, deal alerts, or loyalty programs. It helps keep your work inbox cleaner and limits where your institutional email address is used.
We’re here to help
If something looks suspicious, ask us before you act. You don’t need to prove that a message is malicious before reporting it, and you don’t need to be embarrassed if you clicked a link or responded. The sooner we know, the sooner we can help.
Security works best when we make time to verify, look out for one another, and speak up when something seems wrong. A few seconds spent checking a request can prevent a financial loss and help keep Chapman running smoothly.
Happy Thanksgiving!
Keith Barros
Chief Information Security Officer
Chapman University
Stay safe, stay vigilant
