November and December are busy for just about every business we work with.
You're wrapping up projects, closing out the year, ordering supplies, paying vendors, planning holiday parties, and trying to get everyone's time off on the calendar. Somewhere in there, you're also doing your own holiday shopping on your lunch break.
Scammers know all of that. They know inboxes are full, people are distracted, and a lot of packages and invoices are moving around. So every year around this time, we start seeing more of the same tricks show up in our clients' inboxes and on their phones.
None of this is meant to scare you. Most of these scams are pretty easy to catch once you know what they look like. So here are the ones we see most often during the holidays, and what to do about them.
Why the Holidays Are Such a Good Time for Scammers
Most scams work because they show up at the exact moment you're expecting something like them.
If you just ordered three things online, a text about a delivery problem doesn't seem strange. If your company is paying a pile of year-end invoices, one more invoice doesn't stand out. If the office is planning a gift exchange, a request for gift cards might not raise any eyebrows.
Add in people working shorter weeks, covering for coworkers who are out, and trying to get everything done before the break, and you've got a lot of quick decisions being made on autopilot. That's what scammers are counting on.
Five Holiday Scams We See Every Year
1. The "we couldn't deliver your package" text
This is probably the most common one. You get a text or email that looks like it's from USPS, UPS, FedEx, or Amazon saying there's a problem with your delivery. To fix it, you just need to click a link and confirm your address, or pay a small redelivery fee.
That link goes to a fake site built to collect your card number, your login, or both.
What to do: If you weren't expecting a package from that carrier, ignore it. If you were, don't use the link in the message. Go to the store's website or app where you placed the order and check the tracking there.
2. The gift card request from "the boss"
An employee gets a text or email that appears to come from the owner or a manager. It's friendly and a little rushed: "Are you at your desk? I need a quick favor." Then it asks them to pick up a few gift cards for clients or staff and send over the codes.
It works because it's believable. Plenty of business owners do give gift cards this time of year, and nobody wants to say no to the boss.
What to do: Make it a rule that nobody buys gift cards because of an email or text alone. A quick phone call or a walk down the hall clears it up in seconds. And if you're the owner, tell your team now that you'll never ask for this over text.
3. The invoice with "updated" payment details
Year-end is when a lot of bills get paid, and scammers like to slip in right alongside them. Sometimes it's a fake invoice from a vendor you've never used. Other times it's an email that looks like it's from a vendor you do use, letting you know their bank information has changed.
That second one is the one that costs businesses real money, because the payment goes out and nobody notices until the real vendor calls asking where their check is.
What to do: Any change to a vendor's payment information should be confirmed by phone, using a number you already have on file. Not the number in the email.
4. The year-end HR or benefits email
"Please review your updated holiday schedule." "Action required: confirm your benefits election." "Your year-end bonus details are attached."
These are designed to get employees to open an attachment or sign in to what looks like a Microsoft 365 or payroll page. Once someone enters their password, the scammer can get into their email and everything connected to it.
What to do: Be suspicious of any email that pushes you to sign in from a link, even if it looks like it came from inside the company. If it seems off, check with HR or the person who supposedly sent it before clicking anything.
5. The deal that's a little too good
Black Friday and Cyber Monday bring a flood of ads and emails for big discounts. Some of them lead to fake shopping sites that look just like a real store. You place the order, the money leaves your account, and the product never shows up.
This matters for businesses too, especially when someone is using a company card to order equipment or supplies.
What to do: Type the store's web address in yourself instead of clicking the ad. If you've never heard of the site and the price is way below everyone else's, that's your answer.
A Few Things to Do Before the Holidays Hit
You don't need a big project to protect your business this season. A few small steps go a long way.
Give your team a heads-up. Send a short email or bring it up at your next meeting. Just knowing these scams are coming makes people more likely to pause before clicking.
Set a "call to confirm" rule. Gift card requests, wire transfers, and payment changes always get a phone call first. No exceptions, no matter who it appears to come from.
Make sure multifactor authentication is turned on. If someone does enter their password on a fake page, MFA can stop the scammer from getting any further.
Know who's watching while you're out. If the office is closed for a few days, make sure someone is still keeping an eye on your systems, backups, and security alerts.
Make it easy to ask. The best protection is an employee who feels comfortable saying, "This looks weird, can someone check it?" Nobody should feel silly for asking.
Enjoy the Season (and Slow Down Before You Click)
The holidays should be about wrapping up a good year, spending time with family, and maybe eating more than we should. They shouldn't involve tracking down a payment that went to the wrong bank account.
Most of these scams fall apart if someone takes ten seconds to stop and ask, "Was I expecting this?" That one habit catches more than any piece of software ever will.
And if something shows up that you're not sure about, send it our way. We'd much rather take a quick look at a suspicious email than help clean up after one. You're never bothering us.
At CNR Technologies, we help businesses across North Georgia stay protected all year long, including the busy weeks when everyone's attention is somewhere else.