Halloween is behind us, which means the busiest stretch of the year has officially started: Black Friday, Cyber Monday, year-end orders, holiday parties and a lot of people trying to get things done before taking time off. Scammers know this too. The holiday season is when they send the most fake delivery notices, fake invoices and fake “urgent favor” requests, because they’re counting on busy people clicking first and thinking later.
The good news: almost every one of these scams can be stopped with a few simple habits. Here’s what to watch for over the next eight weeks and what to put in place this week.
Why the holidays are prime time for scams
It comes down to volume and distraction. Your team is ordering supplies, tracking shipments and paying vendors more than usual, so one more “your package couldn’t be delivered” text or “updated invoice attached” email doesn’t stand out. Staff are covering for coworkers who are out, approvals get rushed before long weekends, and computers get left logged in at the front desk.
The numbers back this up. The FTC reports that Americans lost about $3.5 billion to impersonation scams in 2025, with nearly $1 billion of that involving criminals pretending to be a business. Security firm Darktrace saw Black Friday-themed phishing jump more than 600% in business email last November, and Check Point found that roughly 1 in 11 newly registered Black Friday-themed websites in its research was malicious. (Phishing, by the way, just means a fake message designed to trick you into clicking a link, opening an attachment or handing over information.)
The four scams most likely to hit your business
1. Fake delivery and shipping alerts
A text or email claims to be from UPS, FedEx, USPS or DHL: a package is on hold, an address needs confirming, or a small “redelivery fee” is due. The link goes to a convincing copy of the carrier’s site that collects your card number or login. These messages ramp up from October through January, right when your business is actually expecting shipments, which is what makes them work.
The fix: Never track a package from a link in an unexpected message. Open the carrier’s app or the supplier’s website yourself and check the order there. Real carriers don’t text you asking for a fee to release a package.
2. “We changed our bank details” vendor fraud
This is one of the costliest scams for businesses. A scammer poses as a supplier you already pay, sometimes from a hacked email account belonging to that real supplier, and says their bank account has changed. The next invoice goes to the criminal’s account. They often time it right before a holiday weekend so nobody can double-check. Security professionals call this business email compromise, or BEC.
The fix: Make it a firm rule that any change to a vendor’s payment details gets confirmed by phone, using a number you already have on file, not the one in the email. No exceptions, no matter how urgent it sounds.
3. The “boss” who needs gift cards
An employee gets a text or email that appears to be from the owner or a manager: “Are you free? I need a quick favor.” The favor is buying gift cards for a client gift or holiday party, then sending photos of the card numbers. The FTC warned about this exact scam again this year. Once the numbers and PINs are sent, the money is gone.
The fix: Tell your team, out loud and in writing, that you will never ask them to buy gift cards by text or email. Anyone who gets that request should call you on your known number before doing anything.
4. Fake deals and fake login pages
Too-good-to-be-true discounts on equipment, software renewals or office supplies lead to look-alike websites. Some steal company card numbers. Others show a fake Microsoft 365 or Google sign-in page, and if an employee reuses their work password, the scammer now has access to your email. Researchers at Kaspersky also found a big jump this year in malware disguised as popular AI apps and video-meeting tools, so “free download” offers deserve extra suspicion too.
The fix: Buy from vendors you already know, type web addresses in yourself, and turn on multi-factor authentication (MFA). MFA means a second step, like a code on your phone, is required to log in, so a stolen password alone isn’t enough.
Don’t forget your phone lines
Scams don’t only arrive by email. Callers posing as your bank, your carrier or even “IT support” will try to get staff to read back a verification code or approve a login. Remind your team that a real bank or vendor will never call and ask for a code that was just texted to them. If you have a VoIP phone system, it’s also worth confirming that voicemail PINs aren’t left at the default and that international calling is restricted if you don’t need it. Toll fraud, where criminals rack up expensive calls through a hijacked phone system, tends to spike over long holiday weekends when nobody’s watching.
What you should do this week
- Send a two-minute heads-up to your team. Describe the four scams above and tell them who to contact if something looks off.
- Put the “call to verify” rule in writing for any vendor bank-detail change or unusual payment request.
- Announce that you’ll never request gift cards by text or email, and that staff should always confirm by phone.
- Turn on MFA for email (Microsoft 365 or Google Workspace), banking and any shipping or supplier accounts.
- Bookmark the real carrier and supplier sites so staff check orders there, not through links.
- Set computers to auto-lock after a few minutes, especially shared or front-desk machines.
- Review your phone system: change default voicemail PINs and block international dialing if you don’t use it.
- Make reporting easy. Thank people who flag suspicious messages, even when it turns out to be legitimate.
We’re here to help
None of this requires a big budget, just a little planning before the rush. If you’d like a hand turning on MFA, locking down your phone system or giving your team a quick scam-awareness refresher, contact Valentine Systems. We’ll help you get set up so you can enjoy the season without worrying about what’s waiting in your inbox.
Sources
- Symmetric Group: From Halloween to Black Friday: Holiday Cybersecurity Threats Businesses Overlook (summarizes FTC, Darktrace, Check Point and Stripe figures)
- FTC Consumer Alert: No, that’s not your boss asking you to buy gift cards
- KIRO 7: Package and delivery scams spike as early holiday sales begin
- Kaspersky Securelist: Threat landscape for SMBs in 2026
