Holiday scam season: how to spot phishing before it costs you

Every year, somewhere around the second week of December, an office manager forwards us an email with one line on top: “Is this real?” It says a package couldn’t be delivered. Or a vendor has new bank details. Or it’s a text from the owner asking someone to grab a few gift cards for clients, quickly, before a meeting.

Most of the time, it isn’t real. And the reason it gets forwarded instead of deleted is that it looks almost exactly like the real messages arriving that same week.

The short answer

Holiday phishing works because it hides inside the busiest, most rushed weeks of the year, when shipping notices, invoices and favors from the boss are all normal. You don’t need expensive tools to beat most of it. You need a few habits your whole team follows: verify any request for money through a phone number you already have, never buy gift cards because of an email or text, go to websites directly instead of clicking links, and make it easy and blame-free to report something that looks off.

Why the holidays are different

Scammers don’t get smarter in November. Your office just gets busier, and that does their work for them. Between Thanksgiving and New Year’s:

• Real shipping notices flood everyone’s inbox, at work and at home, so one more doesn’t stand out.
• Vendors push to get invoices paid before year-end, so a payment request with a deadline feels routine.
• People are out of the office, which makes “I’m in meetings all day, can you handle this?” believable.
• Gift cards are a normal holiday purchase, so a request to buy some doesn’t sound strange.
• Everyone is rushing, and rushing is exactly what a scam needs you to do.

Holiday scams to watch for

Phishing is the most reported cybercrime in the country. In the FBI’s 2025 Internet Crime Report, phishing and spoofing led every other category with more than 191,000 complaints. For a law firm or a business with 10 to 100 people, it usually shows up in one of these four forms, and all four pick up during the holidays.

Fake shipping notices. “Your package could not be delivered. Confirm your address.” The link goes to a page that looks like a carrier’s site and asks for a small redelivery fee or your sign-in details. Offices that receive deliveries, supplies and client gifts all season are easy targets, and these now arrive as text messages to the personal phones employees also use for work.

Bogus invoices and payment changes. This is the expensive one. The FBI counts it as business email compromise, and in 2025 it cost victims more than $3 billion, second only to investment fraud. An email that appears to come from a vendor you actually use says their bank has changed and asks you to update payment details before the next invoice. Sometimes it really does come from the vendor’s account, because their email was broken into first. For law firms, the same trick targets wire instructions for settlements, closings and trust account disbursements. The amount looks right and the money goes to a criminal. Once a wire or ACH payment is sent, getting it back depends on how fast you act.

Gift card requests. A text or email that looks like it’s from the owner, a partner or a manager: “Are you at your desk? I need a favor.” The favor is buying gift cards for “client appreciation” and sending the codes in a photo. In a smaller office where everyone knows the boss, it works precisely because good employees want to help.

Fake Microsoft 365 sign-in pages. This is the one most small businesses actually get, all year long. An email says a document has been shared with you, your mailbox is full or your password is about to expire. The link opens a page that looks exactly like the Microsoft sign-in screen. Type your password there and someone else can read your email, send messages as you and set up the invoice scam above from inside your own account. Around the holidays the bait changes to year-end bonus statements, holiday schedules and benefits enrollment notices, but the page behind it is the same.

How to spot one in ten seconds

You don’t need to be technical. Before clicking, paying or replying, look for these:

• Urgency. “Today,” “within 24 hours,” “before the end of the day.” Real vendors and carriers rarely give you hours to act.
• A change to how money moves. New bank details, a new payment portal or a request to pay a different way than usual.
• Secrecy or unusual channels. “Don’t mention this to anyone yet,” or the boss suddenly texting from a number you don’t recognize.
• A sender address that’s close but not right. An extra letter, a different ending, or a reply-to address that doesn’t match the sender.
• A link that goes somewhere else. Hover over it on a computer, or press and hold on a phone, and look at where it actually leads.
• A request to sign in. Any page you reached from an email that suddenly wants your Microsoft 365 password deserves a second look.

Habits that keep your team from clicking

Training helps, but habits are what hold up on a busy Friday afternoon. These are the ones we ask every client to adopt:

• Verify money by phone. Any new bank details or unusual payment request gets a call to a number you already have on file, not the one in the email. Make this a rule, not a judgment call.
• No gift cards by email or text. Ever. Tell your team plainly that leadership will never ask for gift cards that way. Then nobody has to wonder.
• Go direct. If a shipping notice seems plausible, open the carrier’s app or type the website yourself and check the tracking number there.
• Make reporting easy and blame-free. Show everyone the Report button in Outlook, and thank people who use it. The employee who says “I think I clicked something” in five minutes saves you far more than the one who stays quiet for a week.
• Turn on multi-factor sign-in for email. If someone does type their password into a fake page, multi-factor authentication in Microsoft 365 stops most of those stolen passwords from working.
• Do a ten-minute huddle before Thanksgiving. Show two or three real examples, repeat the rules above and remind people that asking is always fine.

What to do if someone clicks

It happens to careful people. What matters is speed. If someone entered a password on a suspicious page, change it right away and call your IT provider so they can check the account for anything left behind, like forwarding rules that quietly copy your email to someone else. If money went out, call your bank immediately and ask them to recall the payment; the first few hours matter most. Business email fraud can also be reported to the FBI at ic3.gov. And if gift card codes were sent, contact the card issuer at once, since sometimes the balance can be frozen before it’s spent.

What to ask a provider

Whether you’re reviewing your current IT company or talking to a new one, these questions tell you how prepared your business really is:

• Is multi-factor authentication turned on for every email account, including the owner’s and any shared mailboxes?
• What email filtering do we have, and do you review what it catches?
• If someone reports a suspicious email, who looks at it and how fast?
• If someone clicks, what do you check on their account, and how quickly can you respond?
• Do you provide phishing awareness training or simulated phishing tests, and how often?
• Do we have a written process for verifying payment changes, and has the team seen it?

A good provider will have specific answers. If the answers are vague, that’s worth knowing before December, not after.

Why we wrote this

Raven Managed Services is a managed IT and cybersecurity provider in Marietta, Georgia, working with law firms and growing businesses across metro Atlanta and nationally. We see the same holiday scams hit small and mid-sized businesses every year, and most of them are stopped by a few habits put in place before the rush. If you want help getting your team ready, send us a note or grab thirty minutes.

Common questions