M&S goodwill gift card email sparks scam attack fears

Marks & Spencer’s attempt to woo customers back by sending out thousands of £10 gift cards to those affected by its recent cyber-attack is in danger of backfiring amid widespread fears that the genuine email could actually be a scam.

The emails, which come from Marks & Spencer Service and are signed off from “Your M&S Team” are being sent to customers who either had their online order cancelled or experienced delays to their Click & Collect order as a result of the April “cyber incident”, which caused mayhem in shops and left online orders suspended.

The email states: “As promised, we’re sending you an e-gift card. You can use your e-gift card to buy any of our fantastic food, wine, clothing, homeware, lingerie and beauty products, either online at marksandspencer.com or in one of our stores.

“Gift cards are valid for 48 months from the date of the last transaction and are non-refundable. You can read the full terms and conditions here. We hope you’ll enjoy using it.

“Don’t lose your e-gift card! It’s super easy to add your gift card onto your M&S account so it’s safe and simple to access. Just click here and follow the easy steps. Don’t have an account? You can sign up when you save your e-gift card.”

However, the move comes as consumer organisation Which? has issued a major warning to M&S customers to be on alert over a potential spate of scam emails.

Lisa Webb, a consumer law expert at Which?, said: “It’s only a matter of time before scammers start using the M&S cyber-attacks as a way to part people from their hard-earned cash. M&S has sent gift cards to some customers, but scammers are also sending fraudulent emails offering afternoon tea hampers if you complete a survey.”

And some M&S shoppers who have received the genuine messages have already raised concerns, not only due to the fact that the emails have arrived out of the blue, but that you have to click on the link to find out how much your gift card is worth.

Writing on Reddit, one M&S shopper questioned: “Did anyone else get a random apology M&S voucher in an email? Just aware that they got hacked and I’m not sure whether some customer data was taken? Not sure if it’s a scam or not.”

Another wrote: “Has anybody else been unexpectedly sent a £10 gift voucher from M&S themselves? I have had an email this evening and it all appears legit, I am just unsure why? My best guess is due to an order that was cancelled back in late April amidst the cyber-attacks. Anybody else receive one?”

Meanwhile, on X, another customer wrote:”@Marksandspencer I’ve been contacted about an e-gift card from this email address: email@service.marksandspencer.com. Is this real?”

One Decision Marketing reader, who received the gift card email last night, said: “To be honest, I thought twice about opening it, and then clicking through, despite the email address appearing genuine. What could have been a great gesture is in danger of causing even more confusion. M&S could have shot itself in the foot – many customers might not even open the message.

“Naturally we don’t know how many gift cards it is sending out but why use email at all? Surely on this occasion it would have been far better to use direct mail. OK, it might have cost a bit more, but it would have avoided any confusion over whether the message was genuine or not at a time when scammers are running riot.”

The retailer’s current “Summer Like You Mean It” campaign (pictured), devised by Mother, invites customers to celebrate all the small things that make summer unforgettable, and showcases styles for both big plans and small moments. However, it does not make a single mention of the online shopping site, M&S.com, which the company confirmed this week will not be fully operational for another month.