New Hire Cyber Scam: How to Protect Employees from WhatsApp and Gift Card Fraud

As hybrid work becomes the standard, cybercriminals are exploiting the gaps in onboarding processes to target new hires. One increasingly common scam impersonates company executives and tricks employees into sending gift cards via WhatsApp. Here's how it works and how you can protect your team.

How the Scam Works

A new employee receives what appears to be an email from a senior leader—often their manager or the CEO. The message is friendly, informal, and carries a sense of urgency:

“Hi! Are you available to help with a quick task? Can you send me your mobile number so I can message you on WhatsApp?”

Once the employee responds, the scammer takes the conversation off email and asks them to buy Apple gift cards or other vouchers with their personal funds, promising reimbursement. These funds, of course, are never recovered.

Why New Employees Are at Risk

• They don’t yet know internal communication norms

• They may not have met their manager or CEO in person

• They want to prove themselves and be helpful

• Spoofed emails look convincingly real

But there’s another reason these scams work so well...

The Hidden Risk: Publicly Available Information

Many scammers gather details from public sources to make their attacks more believable:

• LinkedIn job announcements ("Excited to start my new role at XYZ!")

• Company websites listing staff names and positions

• Social media posts mentioning new team members or internal promotions

This gives attackers enough information to convincingly impersonate real executives and make targeted phishing attempts appear authentic.

Top Tip: Be cautious about what you share publicly, especially about new hires or internal contact details. Review your organisation's policy on what’s posted online.

How to Protect Your Organisation

✅ Educate New Starters Immediately
Include phishing and scam awareness in your onboarding. Use real examples like this one.

✅ Set Communication Boundaries
Make it clear that leadership will never ask employees to buy gift cards or communicate through WhatsApp for work matters.

✅ Use Security Tools to Detect Spoofing
Implement email security systems that flag or block impersonation attempts.

✅ Audit What’s Public
Limit what’s shared online about new joiners, staff contact details, or internal changes.

✅ Encourage a Speak-Up Culture
If something feels off, employees should feel safe to double-check before taking action.

Cybersecurity starts with awareness, especially for those just joining your team.

Want a ready-to-use guide for new hires on spotting and reporting scams? We’d be happy to help.