WhatsApp & Messenger Gift Card Scams — How Hijacked Accounts Trick Friends

"Hey, are you busy? Can you do me a quick favor? I need you to pick up some Google Play gift cards for me. I'll pay you back."

This message appears to come from a close friend on WhatsApp, Messenger, or iMessage. But your friend didn't send it. Their account has been hijacked, and a scammer is using their identity to trick everyone on their contact list.

The FTC reported that gift card scams cost Americans over $217 million in 2025, making them one of the most profitable fraud schemes.

How the Scam Works

Step 1: Account Takeover

Scammers first hijack someone's messaging account through:

• Phishing links — "Is this you in this video?" messages that steal credentials
• Credential stuffing — using leaked passwords from data breaches
• Verification code tricks — "I accidentally sent a code to your number, can you forward it?"

Step 2: Messaging the Contact List

Using the hijacked account, they message all contacts with casual, friendly requests.

Typical messages:

• "Hey, are you free? I need a small favor"
• "I'm stuck in a meeting, could you grab some gift cards for me?"
• "Can you buy 2 iTunes cards ($50 each)? I'll Venmo you back"
• "Just scratch the back and send me photos of the codes"

Step 3: Requesting the Codes

The key is getting photos of the codes on the back of the cards. With just the codes, scammers can drain the value remotely.

Step 4: Instant Liquidation

Codes are immediately redeemed or sold on resale markets. The money is virtually untraceable.

Why People Fall for It

• It comes from a trusted friend — no reason to doubt
• Small amounts — $50-$200 feels manageable
• Urgency — no time to think
• Social obligation — hard to say no to a friend

Red Flags to Watch For

Warning Sign	Details
Sudden gift card request	Out-of-character conversation
"Send photos of the codes"	They know codes are all that's needed
Specific amounts	"$50 cards, 2 of them"
Refuses phone calls	"Can't talk right now"
Slightly off tone	Writing style is a bit different
Only through messaging	Won't use other contact methods

What To Do When Asked to Buy Gift Cards

1. Don't buy anything — no matter how urgent it seems
2. Call them directly — use phone, not the same messaging app
3. Verify through other channels — text, email, another social platform
4. Ask specific questions — "What's the gift card for?" Scammers can't give detailed answers

If Your Account Gets Hijacked

1. Report to the platform — WhatsApp, Facebook, etc.
2. Change your password if you can still log in
3. Warn all contacts — via phone call, text, or email: "My account was hacked. Gift card requests are scams"
4. File a report with the FTC at reportfraud.ftc.gov

5 Rules to Protect Your Messaging Accounts

1. Enable two-factor authentication on every messaging app
2. Never share verification codes — no legitimate service asks for these
3. Use unique passwords for each platform
4. Be skeptical of links — even from friends
5. Turn on login notifications to detect unauthorized access

How to Safely Send Gift Card Codes

When you legitimately need to send a gift card code to someone, pasting it in a chat is risky. If either account gets compromised, the code is exposed in chat history.

LOCK.PUB lets you wrap gift card codes in a password-protected, self-destructing memo. Only the recipient with the password can view it, and the content disappears after reading. Free, no app needed.

Gift Card Scams Beyond Messaging

Platform	Common Tactic
Email	Boss impersonation — "Buy gift cards for client gifts"
Phone	IRS/tech support scam — "Pay your tax debt with gift cards"
Dating apps	Romance scam — "Send me gift cards so I can visit you"
Social media	Celebrity impersonation — "Send gift cards to enter giveaway"

Final Thoughts

Gift card scams exploit the most basic human instinct: helping a friend. The amounts seem small, the request seems reasonable, and it comes from someone you trust. That's exactly what makes it so effective.

The rule: if anyone asks you to buy gift cards and send the codes, call them to verify. No exceptions.

For safely sharing gift card codes or sensitive information, use LOCK.PUB's encrypted memos — free, secure, and self-destructing.

A real friend will always understand if you call to double-check.