Holiday Phishing Scams That Target Small Businesses

Every November and December, phishing against small businesses jumps — and not because attackers get cleverer. The season hands them perfect cover: inboxes full of real shipping notices and invoices, year-end payments going out, approvers on vacation, and everyone in a hurry. The same five scams show up every year, and a handful of habits stop nearly all of them.

Why the holidays are open season

Phishing works when a fake message looks like the real ones around it. In December, the real ones are everywhere: delivery updates for office orders, vendor invoices that need paying before year-end, benefits enrollment reminders, holiday party sign-ups. At the same time, the people who normally double-check things are out of the office, and the people covering for them do not want to be the reason a payment was late. Attackers know the calendar as well as you do.

The five scams to expect

  • Fake delivery notices. “We missed you — reschedule your delivery” by email or text, with a link to a fake carrier page that asks for a login or a small “redelivery fee.” The goal is a password or a card number. A surprise fee to redeliver a package is the giveaway.
  • Gift card requests from “the boss.” A text or email that appears to come from the owner: “I’m in a meeting, I need you to pick up some gift cards for clients, send me the codes.” It plays on the season of client gifts and the reluctance to question a busy executive. Once the codes are sent, the money is gone.
  • Invoice and banking-detail swaps. A vendor “updates” their bank account right before you pay a large year-end invoice. Sometimes the email really does come from the vendor’s mailbox, because the vendor was compromised first. This is business email compromise, and it is the most expensive scam on this list.
  • Charity and donation appeals. Fake fundraisers piggyback on real causes and disasters, often with a link that harvests a card number or a Microsoft 365 login.
  • HR and payroll lures. “Review your benefits elections,” “Your year-end bonus statement is ready,” “Updated holiday schedule.” These lead to fake sign-in pages that look exactly like Microsoft 365, because a stolen email login is worth more to an attacker than almost anything else.

The controls that stop most of it

You cannot train people to spot every fake — some are flawless. What works is making the dangerous actions require a step an attacker cannot fake.

  • Call back before any payment change. Any request to change banking details, rush a wire, or pay a new account gets verified by phone, using a number you already had on file, never one from the email. This single rule defeats the invoice swap even when the vendor’s real mailbox sent it.
  • Write down the gift card rule. “We never buy gift cards because of an email or text request” — announced by the owner, so nobody has to wonder whether questioning the boss will get them in trouble.
  • Use MFA that phishing cannot steal. Most holiday phishing ends at a fake login page. Phishing-resistant MFA and conditional access mean a typed-in password is not enough to get in, even when someone falls for the page.
  • Authenticate your email domain. SPF, DKIM, and DMARC make it much harder for criminals to send mail that appears to come from your own domain. If yours are not set, start with our explainer.
  • Tag external email. A banner on messages from outside the company makes a fake “owner” email from a lookalike address stand out.
  • Keep out-of-office replies boring. An external auto-reply that announces who approves payments while you are away, or that you are overseas until January, is reconnaissance handed to an attacker. Say you are out and when you are back.

A five-minute holiday briefing for your team

Before Thanksgiving, take five minutes at a staff meeting and cover these points. It is the cheapest security training you will do all year.

  1. Check deliveries by typing the carrier’s site yourself, never through a link in a text or email.
  2. Nobody here will ever ask you for gift cards by text or email. If it looks like they did, call them.
  3. Any change to how we pay someone gets a phone call to a number we already have.
  4. If a sign-in page appears after clicking a link, close it and go to the site directly.
  5. If you clicked something, tell IT right away. Fast reporting turns an incident into a non-event, and nobody gets in trouble for reporting.

If someone already fell for one

Speed matters more than anything else. Reset the affected password, revoke active sessions, check the mailbox for new forwarding rules, and if money moved, call your bank immediately — wire recalls are only realistic in the first hours. Then look for how the message got through so it does not work twice.

Get through the season without an incident

Holiday scams succeed against busy teams, not careless ones. Equal Tech Solutions’ cybersecurity services put the technical controls in place — email filtering, phishing-resistant MFA, domain authentication, and monitoring — for businesses across Cleveland, Chattanooga, and the Southeast, so your team only has to remember a few simple rules. Contact us before the rush, not after the first wire goes missing.