If they did it I would assume they would do it in a way that the employee would need to get some information first (e.g. the amount or type of gift card) before committing to anything. Or directing to buy it from some fake web shop.