Cybersecurity
The holiday scams that target businesses, not shoppers
Every November the internet fills with advice about holiday scams, and nearly all of it is written for shoppers: watch out for fake storefronts, don’t click that shipping notification.
That’s fine advice. The scams aimed at businesses are better targeted, though, and they arrive during the week you’re least able to think carefully. The timing is deliberate.
The fake invoice
An invoice arrives from a vendor you actually use, for an amount that isn’t alarming, at a time of year when dozens of invoices are moving. The bank details are new. There’s a note explaining that they’ve switched banks.
The rule: a change in payment details is never confirmed by the message that requests it. Call the vendor on the number you already had, not the one in the email.
The gift-card request
An email from the boss, or someone senior. Short, apologetic, slightly rushed. They’re in a meeting. They need gift cards for the team, today. Can you handle it and they’ll reimburse you?
It works because it exploits two things every good employee has: a desire to be helpful and a reluctance to question the boss. The defense is a standing rule everyone knows: we never buy gift cards on an email request, with no exceptions. Once a rule has exceptions, an attacker only has to sound like one.
The delivery problem
You’re shipping more than usual, so a “delivery exception” notice doesn’t look strange. The link goes to a login page that looks exactly right. It takes your credentials, and now someone is inside your email, which is the account that can reset all the others.
The charity that doesn't exist
December is when businesses give, and it’s also when fake charities collect. If you’re donating, start the donation yourself. Never go through a link someone sent you.
What actually protects you
None of these are technically sophisticated. They’re social attacks that work on busy people, and December keeps everyone busy.
So the countermeasure is two plain sentences, agreed in advance: we verify payment changes by phone, and we never buy gift cards on request. Say them out loud at a team meeting before December.
Want to know where you actually stand? We do free, no-pressure security checks for small businesses across the East Bay, covering backups, accounts and defenses. We tell you plainly what to fix first.
General guidance on business email compromise and holiday fraud is published by the FTC and CISA.