Confirm unusual payments or gift card requests in person or by calling a number you already know. Replying in the same email thread is not an independent confirmation.
The request looks like an exception
A scammer pretends to be a manager and claims that payment is urgent and confidential. They may say the manager is in a meeting and cannot take questions. Real names and internal terms can make the email look credible. Small organisations and associations can be targets too.
Keep the normal approval process
Follow the established payment checks even under time pressure. Compare recipients and bank details with existing records. Confirm new details through another channel, and involve the second approver when your organisation requires one. A request to keep colleagues in the dark is no reason to skip controls.
If payment already went out
Tell the bank and responsible person at once; the bank can assess whether a transfer can still be stopped. If gift card codes were sent, contact the issuer. Preserve the email and payment records. Your IT team should check whether an account was compromised or only a sender address was spoofed, and whether others received the message.
Unusual requests need confirmation outside email, even when they appear to come from the boss.
Sources and further help
The linked information supports this guide. It does not imply that these organisations work with or endorse MailMigo.