Holiday Phishing Scams to Warn Your Team About
Don’t Make It Easy for Them
By David Luft | CEO, LDD Consulting | MCSE, MCT, MBA | Published October 29, 2026 | 6 min read
THE SHORT ANSWER
Phishing picks up as the holidays approach. Inboxes fill with shipping notices, year-end invoices, and gift requests, and busy, distracted employees are more likely to click before they think. Scammers know this and time their messages to match. A short briefing with your team before the rush — what the common scams look like, what the red flags are, and exactly who to tell when something seems off — is one of the cheapest, most effective defenses a small business has.
Why October is the Time to Brief Your Team
October is Cybersecurity Awareness Month, and this year the National Cybersecurity Alliance’s theme is “Don’t Make It Easy for Them”. It’s a fitting message for small businesses heading into the holidays, because most email scams don’t break in. They get invited in by someone who’s busy, trying to be helpful, or moving too fast.
The cost is real. Business email compromise — scams that trick employees into sending money or sensitive information — cost U.S. victims about $3 billion in 2025, according to the FBI’s Internet Crime Complaint Center. That’s the second-largest loss of any crime type the FBI tracks, and those are only the losses that got reported.
The weeks between Thanksgiving and New Year’s are when these scams have the most cover. Briefing your team in late October means they see the warning before the first fake shipping notice lands, not after.
Pro tip: Your team doesn’t need to become security experts. They need to recognize a handful of patterns and know who to call. That’s a 15-minute conversation, not a training program.
The Scams to Warn Your Team About
Gift Card Requests From “the Boss”
An email or text that appears to come from the owner or a manager asks an employee to quickly buy gift cards — for clients, for staff, for a holiday surprise — and send the codes. The message is friendly, a little rushed, and often says the sender is in a meeting and can’t talk.
Fake Shipping and Delivery Notices
With packages arriving daily, a message saying a delivery failed or needs a fee paid doesn’t seem unusual. The link leads to a fake carrier page that steals login details or card numbers.
Invoice and Payment-Change Fraud
A vendor you really work with appears to send a year-end invoice, or a note saying their bank details have changed. The email may come from a lookalike address or even the vendor’s real account if it’s been hacked. Payments go straight to the scammer.
Fake Holiday E-Cards, Party Invites, and Charity Appeals
A cheerful message with a link or attachment — an e-card, a holiday party sign-up, a disaster relief donation page. One click can install malware or lead to a fake login page.
Text Message Versions of All of These
Scammers increasingly use texts (sometimes called smishing) because phones don’t have the same filters as company email, and people tend to trust texts more. Every scam above has a text message version.
Pro tip: Email filtering in your cloud email platform catches a lot of these, but not all. The ones that get through are usually the most convincing — which is exactly why the human layer matters.
What’s New This Year: AI-Powered Scams
AI hasn’t invented new scams so much as made the old ones far more convincing — and much easier to run at scale. For the first time, the FBI’s 2025 Internet Crime Report tracked AI-related complaints separately: more than 22,000 complaints and nearly $900 million in reported losses, driven mainly by voice cloning, deepfake video, and AI-written scripts. Here’s what that looks like inside a small business.
Flawless Phishing Emails
For years, typos and awkward wording were the easiest way to spot a scam. Not anymore. AI tools write clean, natural emails in seconds, can mimic a specific person’s writing style, and can reference real details pulled from your website or LinkedIn. A perfectly written email is no longer evidence that it’s legitimate.
Cloned Voices and Deepfake Video Calls
Scammers can now clone someone’s voice from a short clip of public audio — a podcast, a webinar, a social media video. That means the call from “the owner” asking for an urgent wire transfer may actually sound like the owner. The FBI’s report describes exactly this: voice cloning and AI chat tools used to impersonate executives and request payments. In more elaborate cases, scammers have used deepfake video to impersonate executives on live calls.
Fake “IT Support” Calls
In May 2026, the FBI warned that a criminal group has been calling law firm employees while posing as their IT department, talking them into installing remote access tools, and stealing sensitive data — sometimes within an hour. When phone calls failed, the group even sent people to offices in person, posing as IT technicians. Law firms have been the main target, but the tactic works against any business.
Pro tip: Agree on a verification step for any unexpected request involving money or system access — a callback to a known number, or a code word only your team knows. A cloned voice can’t answer a question it was never trained on.
Red Flags Anyone Can Spot
The details of each scam change, but the warning signs stay remarkably consistent:
- Urgency: “I need this in the next hour.” “Your package will be returned today.” Pressure to act fast is the most common tactic there is.
- Secrecy: “Don’t mention this to anyone yet — it’s a surprise.” Legitimate requests rarely need to be kept quiet.
- Unusual payment methods: gift cards, wire transfers to new accounts, or payment apps — especially when that’s not how your business normally pays.
- Changed details: a new bank account, a new phone number, or a slightly different email address for someone you already know.
- Mismatched senders: the display name looks right, but the actual email address doesn’t. On a phone, this is easy to miss.
- Unexpected links or attachments: especially ones asking you to log in, “verify” something, or open a document you weren’t expecting.
One warning sign to retire: bad spelling and grammar. With AI writing the messages, scams now read as cleanly as anything else in your inbox. Focus on what the message is asking you to do, not how well it’s written.
Pro tip: One red flag is worth a pause. Two or more is worth a phone call.
What to Do When Something Feels Off
The right response is simple enough to put on a sticky note:
- Stop. Don’t click, reply, download, or pay.
- Verify another way. Call the person or vendor using a phone number you already have — not one from the message. A quick walk down the hall works too.
- Report it. Forward the message to whoever handles IT and let them know if anything was clicked or entered.
The third step matters most, and it only works if reporting feels safe. Employees who are embarrassed about clicking tend to stay quiet, which gives an attacker more time. Make it clear that reporting quickly — even after a mistake — is always the right call.
If you work with an IT support provider, give your team one clear way to reach them, and make sure everyone knows it before the holidays.
Pro tip: Thank people publicly when they report a suspicious message, even when it turns out to be harmless. It’s the fastest way to build a team that speaks up.
How to Run a 15-Minute Team Briefing
You don’t need slides or an outside trainer. A short conversation at your next staff meeting covers what matters:
- Minutes 1–3: Why now. Explain that scams pick up before the holidays and that the team is the last line of defense.
- Minutes 4–8: The scams. Walk through the scams above, including the AI-powered ones. If you’ve received a real example, show it — with the links removed.
- Minutes 9–11: The red flags. Urgency, secrecy, unusual payments, changed details. Ask the team which ones they’ve seen.
- Minutes 12–14: The response. Stop, verify another way, report. Confirm exactly who to report to and how.
- Minute 15: The rule for money. Agree that no payment, bank change, or gift card purchase happens based on an email, text, or phone call alone — ever. Every request gets verified, even when the voice sounds familiar.
For businesses in healthcare and other regulated industries, security awareness training isn’t optional. HIPAA, for example, requires it as part of the Security Rule, so keep a simple record of who attended and when. It’s an easy win for your compliance documentation.
Pro tip: Repeat the briefing in a shorter form in mid-December. A two-minute reminder right before the busiest week does more than a long session in October alone.
Common Mistakes Businesses Make
Mistake 1 — Relying on Once-a-Year Training
A long annual training session is easy to sit through and easy to forget. Short, frequent reminders tied to what’s actually happening — like the holiday season — stick far better.
Mistake 2 — Embarrassing People Who Click
Calling someone out for falling for a phishing email teaches the whole team one lesson: don’t admit it next time. That silence is what turns a quick fix into a serious incident.
Mistake 3 — Having No Clear Person to Report To
“Let IT know” isn’t a plan if no one knows who IT is or how to reach them after hours. Name the person, the email address, and the phone number.
Mistake 4 — Treating Email Filters as a Complete Defense
Filters catch a lot, but the most convincing scams are designed to get through. Strong cybersecurity combines technology with a team that knows what to watch for.
Mistake 5 — Skipping the Money Rule “Just This Once”
Most costly losses happen when someone makes an exception because the request seemed legitimate and the usual approver was busy. The rule only works if it holds every time — especially in December.
Frequently Asked Questions
Report it right away, even if nothing seemed to happen. If they entered a password, it should be changed immediately. If they downloaded something, the device should be checked. Speed matters far more than blame.
They can be, when they’re used to teach rather than to catch people out. A few realistic test emails a year, followed by short, friendly feedback, help people recognize scams in their own inbox.
It stops many attacks that rely on a stolen password, and it’s one of the best protections you can have. But it doesn’t stop an employee from wiring money to a scammer, which is why the human checks matter too.
Increasingly, yes. Many insurers ask whether staff receive security awareness training. We covered what insurers typically look for in Cyber Insurance Readiness: What Insurers Require.
Small teams are often targeted precisely because fewer people handle payments and there are fewer checks along the way. One convincing email to the right person can be enough.
Schedule the 15-minute briefing and agree on the money rule. If you’d like help with email filtering, phishing simulations, or ongoing training, managed IT services can cover all three — or contact us and we’ll walk through what makes sense for your team.
Related Articles & Next Steps
→ Vacation Season Is Peak Season for Cyberattacks — Here’s Why
→ Patch Management for Small Businesses: A Simple Routine
Sources
- Stingrai — Business Email Compromise (BEC) Statistics 2026 (FBI IC3 2025 Internet Crime Report data)
- FBI IC3 — 2025 Internet Crime Report
- Malwarebytes — Americans lost nearly $900 million to AI-powered scams, FBI says
- HIPAA Journal — Silent Ransom Group Targets U.S. Law Firms with Vishing Attacks
- CoinGate — Cybersecurity Awareness Month: Dates, Themes and Tips
David Luft
CEO, LDD Consulting
David founded LDD Consulting in 2003 with a straightforward mission: help small and mid-sized businesses in Albuquerque and across New Mexico get reliable, enterprise-quality IT support without the enterprise price tag. He holds an MBA with a concentration in Information Systems from the University of New Mexico, along with Microsoft Certified Systems Engineer (MCSE) and Microsoft Certified Trainer (MCT) credentials. He’s been solving business technology problems for more than 25 years.