Cybersecurity
The holiday scams that target businesses, not shoppers
Every November, the internet fills with advice about holiday scams — and almost all of it is written for shoppers. Watch out for fake storefronts. Don’t click that shipping notification.
Fine advice. But the scams aimed at businesses are different, and they’re better. They arrive during the week you’re least able to think carefully, which is not a coincidence.
The fake invoice
An invoice arrives from a vendor you actually use, for an amount that isn’t alarming, at a time of year when dozens of invoices are moving. The bank details are new. There’s a note explaining that they’ve switched banks.
The rule: a change in payment details is never confirmed by the message that requests it. Call the vendor on the number you already had — not the one in the email.
The gift-card request
An email from the boss, or someone senior. Short, apologetic, slightly rushed. They’re in a meeting. They need gift cards for the team, today. Can you handle it and they’ll reimburse you?
It works because it exploits the two things every good employee has: a desire to be helpful and a reluctance to question the boss. The defense isn’t technical. It’s a standing rule everyone knows: we never buy gift cards on an email request. Ever. No exceptions. A rule with an exception is not a rule.
The delivery problem
You’re shipping more than usual, so a “delivery exception” notice doesn’t look strange. The link goes to a login page that looks exactly right. It takes your credentials, and now someone is inside your email — which, remember, is the account that can reset all the others.
The charity that doesn't exist
December is when businesses give. It’s also when fake charities harvest. If you’re donating, initiate it yourself. Never through a link someone sent you.
What actually protects you
None of these are technically sophisticated. They’re social. They work on people who are busy, and December is engineered to make you busy.
Which means the countermeasure isn’t software. It’s two boring sentences, agreed in advance: we verify payment changes by phone, and we never buy gift cards on request. Say them out loud at a team meeting before December. That’s the whole defense.
Want to know where you actually stand? We do free, no-pressure security checks for small businesses across the East Bay — backups, accounts, defenses. We tell you plainly what to fix first.
General guidance on business email compromise and holiday fraud is published by the FTC and CISA.