From fake CEO emails to gift card “favours” — here’s how to spot the scams quietly hitting offices across the country.
Have you ever received a random text or email from your boss or CEO asking you to pay an invoice or run a quick favour because they’re “stuck in a meeting”? Pause before you reply. That message could be a workplace scam — and they’re targeting everyone from C-suite assistants to interns on day three.
According to the Canadian Anti-Fraud Centre (CAFC), Canadians lost over $638 million to fraud in 2024, and impersonation scams are among the fastest-growing categories heading into 2026. Worse? Only about 5 to 10 percent of fraud is ever reported, meaning the real damage is significantly higher.
These scammers have essentially mapped out an entire “customer journey” — targeting people from the moment they start job hunting to the moment they settle into a new role. With AI making impersonation easier than ever, fraudsters are slipping into inboxes disguised as someone you’d hesitate to question: your boss, your CFO, or the CEO themselves.
Here are three workplace scams I’ve seen up close — and what they should teach you.
3 Types of Workplace Scams You Need to Know About
1. The “Fake CEO” Email Asking for Your Personal Number
This one happened to me at a previous company.
The email looked completely legitimate — direct, grammatically clean, and using my company’s exact email format. It almost looked identical to my boss’ real email address. Here’s what it said (names and details changed):
From: alex.garrix@12356789.com
Subject: Help Needed for a Corporate Partner
Hi Lily,
Can I please have your mobile number? I’d like to discuss the support needed to purchase a gift for one of our corporate partners.
Thanks,
Alex
Whenever something like this lands in my inbox, I always prefer to clarify in person first. So I walked over to my boss’ office — and he was completely confused. We pulled up the email together and noticed the domain was off by a single digit (the real company domain had a “4” in it, the scammer’s didn’t). Easy to miss when you’re skimming your inbox between meetings.
We looped in IT immediately. They blacklisted the address and sent a company-wide phishing scams alert.
The lesson: Always check the sender’s domain character by character. One missing letter or number is a classic red flag for CEO impersonation fraud.
2. The CFO Text Message About an “Urgent Invoice”
A close friend of mine — a bookkeeper at a small real estate company that still runs manual books — almost got caught by this one.
On a busy afternoon, he got a text from someone claiming to be his CFO, urgently asking him to handle a billing invoice she’d just received. Because he knew his CFO sometimes used a second number for personal messages, he didn’t think twice. The text included a payment link for $2,000 worth of gift cards.
He was literally about to tap “pay” when he paused to ask himself a simple accounting question: Should this be tagged as an entertainment expense (since it was gift cards) or an operating expense? He emailed his CFO to confirm — and her reply nearly stopped his heart. She had never sent the text. Cancel it. Immediately.
He did, just in time.
The lesson: This is a classic smishing scam (phishing via SMS). Even if the request “fits” your knowledge of how your boss communicates, gift cards are almost never a legitimate corporate expense channel. Pause, verify on a known number, and confirm in writing.
3. The Gift Card Scam Targeting Interns
I recently heard about an intern — fresh into the workforce, unfamiliar with company protocols — who received a message from the “CEO” asking her to buy gift cards for an upcoming company campaign. Eager to impress and not wanting to delay ,she went out and purchased $600 worth of gift cards out of pocket.
She went straight to Shoppers Drug Mart, paid out of pocket, and was instructed by the scammer to scratch the back of the cards and text over the PINs. She scratched them, but right before hitting “send,” an intuition kicked in. She paused, checked in with her team, and realized she had almost fallen victim to a major workplace scam.
The lesson: Interns and new hires are deliberately targeted because they don’t yet know what “normal” looks like in their workplace. If you’re new — or if you manage new hires — make verification protocols part of onboarding from day one.
How Do These Scammers Find You?
This is the question that haunts me most: how do they get your name, email, and phone number so quickly?
My honest suspicion is LinkedIn. Many professionals add their mobile numbers to their LinkedIn profiles, hoping recruiters or potential business partners will reach out — but scammers harvest those same details. LinkedIn is also where they map out company org charts, figuring out exactly which junior employees report to which senior executives.
Company email addresses are even easier. Most follow a predictable format (firstname.lastname@company.com), so once a scammer knows your name and employer — both publicly visible on LinkedIn — your work email is essentially a 30-second guess.
The takeaway: Audit your LinkedIn profile. Remove your personal cell number from the public “Contact Info” section unless you absolutely need it there.
What to do when you encounter certain scams in Canada
If you (or someone on your team) has fallen for a workplace scam, act fast:
- Contact your bank or the gift card issuer immediately — some transactions can still be reversed within hours.
- Report to your local police service.
- Report to the Canadian Anti-Fraud Centre (CAFC) at 1-888-495-8501 or online at antifraudcentre-centreantifraude.ca. Report even if no money was lost — your report helps protect the next person.
- Alert your IT and finance teams so they can warn the rest of the company.
Technology is making workplace scams more convincing every year — AI-generated emails, deepfake voice notes, spoofed phone numbers — and small to mid-sized businesses without dedicated cybersecurity teams are the prime targets.
The single best defence isn’t software. It’s a workplace culture where it’s totally normal — even encouraged — to pause, question, and verify. Even if the request is coming from the very top of the org chart.
Have you encountered a workplace scam? Notable Life would love to hear your story — and the more we share these experiences, the harder it gets for scammers to keep winning.
