Holiday-Season Scams: Protecting a Small Team From Fraud and Phishing

The months leading up to the holidays are busy for nearly every business. Orders increase, staff take time off, deliveries pile up and everyone is moving quickly. Scammers know this. Fraud attempts that might be spotted on a quiet day in March can slip through on a hectic afternoon in December. A few clear controls, agreed on in October, help a small team stay alert when it matters most.

Scams to watch for

• Fake delivery notices. Emails and texts claiming a package could not be delivered, with a link to reschedule or pay a fee.
• Gift card requests. A message that appears to come from the owner or a manager asking an employee to buy gift cards for clients or staff and send the codes.
• Vendor payment changes. An email, seemingly from a supplier, announcing new bank account details just before a large payment.
• Fake invoices. Bills for products or services never ordered, timed to blend in with year-end paperwork.
• Charity scams. Requests for donations from organizations that sound legitimate but are not.
• Fraudulent orders. For retailers, orders placed with stolen cards, often for high-value items with rush shipping.

Controls that work

Simple, consistent rules protect better than relying on everyone to spot every trick:

• Require verification by phone, using a known number, for any change to payment instructions.
• Require a second person to approve payments above a set amount.
• Make it a firm policy that the business never asks employees to buy gift cards by email or text.
• Only pay invoices that match a purchase order or known agreement.
• Check delivery and account status by going directly to the carrier’s or vendor’s website, not through links in messages.
• Research charities before giving through official resources.

Prepare for staff absences

Holiday time off can leave unfamiliar people covering tasks like paying bills or handling customer accounts. Fraudsters sometimes exploit that confusion. Before the season starts, document who covers what, make sure substitutes know the verification rules and avoid sharing passwords as a workaround. Use the access controls in your systems to grant temporary permissions instead.

Keep the team informed

A short reminder at a staff meeting in October or November is often enough to raise awareness. Share examples of real suspicious messages the business has received. Encourage people to pause and ask when something feels off, and thank them when they do. Make reporting easy and free of blame.

If something goes wrong

Act quickly. If money was sent, contact your bank immediately, since speed can sometimes make a difference. Change any compromised passwords and check that multi-factor authentication is enabled. Report fraud to the Federal Trade Commission at reportfraud.ftc.gov and, for internet-enabled crimes, to the FBI’s Internet Crime Complaint Center at ic3.gov. Consider consulting an attorney or IT security professional if sensitive data or significant funds are involved.