We had an employee fall for this exact scam, the only reason it failed is we are a smaller company so rather than reply our employee physically handed the cards

We had an employee fall for this exact scam, the only reason it failed is we are a smaller company so rather than reply our employee physically handed the cards to our CEO. She had bought 2k worth of target gift cards. Needless to say, our CEO was very confused. I looked at the phishing email, and in Gmail it looked very legit, since by default the email address isn't visible. The email had the correct first & last name of the CEO, only clicking on the header showed the from email didn't match our CEOs email. I was shocked that a company as small as ours was targeted, this phishing attempt was clearly not bot generated and the English in the email was very good, the only thing that was fishy was the request for gift cards.