The weeks between Thanksgiving and New Year's are some of the busiest of the year for attackers. Your team is distracted, inboxes are full, and a flood of legitimate messages about shipping, gifts, year-end invoices, and benefits makes a fake one much harder to spot. Attackers know this, and they build their campaigns around it.
The good news is that holiday phishing leans on a short list of familiar tricks. If your employees know what to look for, and your business has a few simple safeguards in place, most of these attempts fail. Here's what to expect and how to get ready.
The Lures to Watch For
Package and shipping alerts: "Your delivery could not be completed" messages, with a link to reschedule or pay a small fee, show up in volume this time of year. Employees are shopping online from work devices and expecting packages, so the message feels plausible. The link leads to a fake login page or a malware download.
Gift card requests from the boss: A message that appears to come from the owner or a senior manager asks an employee to quietly buy gift cards "for clients" and send the codes. The sender's name is real; the email address is not. The request usually stresses urgency and secrecy.
Fake invoices and vendor bank changes: Year-end is when accounts payable is busiest. An invoice from a familiar vendor with "updated" payment details, or a request to change where payments are sent, is a classic way to redirect real money to an attacker.
Benefits enrollment and HR messages: Open enrollment, payroll, and year-end tax paperwork give attackers believable reasons to send "action required" messages that point to a fake employee portal and harvest logins.
Shared documents and e-signature requests: A "document waiting for your signature" or a shared file notification is routine business traffic, which is exactly why it's so effective. The link opens a fake Microsoft 365 or Google sign-in page.
Holiday e-cards, charity appeals, and gift offers: Greeting cards with attachments, urgent donation requests, and "exclusive" gift offers all play on goodwill and the season.
QR codes and fake MFA prompts: QR codes in emails and flyers can hide a malicious link from the usual filters, and attackers will sometimes bombard someone with login approval prompts hoping they'll tap "Approve" just to make it stop.
Red Flags Your Team Can Learn in a Minute
Urgency or secrecy: Real requests rarely demand that you act immediately and tell no one.
A mismatch between the name and the address: A familiar display name can sit on top of an unfamiliar or slightly misspelled email address. Check the actual sender.
Links that don't match their label: Hover over a link before clicking. If the destination looks wrong, don't click it. Go to the company's website directly instead.
Requests for money, codes, or credentials by an unusual route: Gift cards, wire changes, and "verify your password" requests are almost never legitimate when they arrive by email or text.
A login prompt you didn't start: If you didn't just try to sign in, don't approve the request, and report it.
What Your Business Can Do Now
Set a verification rule for money: Any change to payment details, any wire request, and any gift card purchase gets confirmed by calling the requester on a number you already have on file, not one from the message. This single policy defeats most invoice and executive-impersonation scams.
Make sure multi-factor authentication is on everywhere: MFA won't stop every phishing attempt, but it turns a stolen password from a disaster into an inconvenience. Number matching and app-based approvals are stronger than text codes, and an identity provider with single sign-on, as we covered in our article on SSO, makes it easier to enforce consistently.
Lock down your email domain: Properly configured SPF, DKIM, and DMARC records make it much harder for someone to send mail that pretends to come from your company. You can check yours with our Email Domain Scanner.
Give people an easy way to report: A report-phishing button or a dedicated address removes the friction. Make it clear that reporting a suspicious message, even one they already clicked, will never get anyone in trouble.
Send a short reminder before the rush: A brief note to the whole team, listing the handful of scams above, goes a long way. Short, timely reminders work better than a long annual training session that everyone forgot by spring. Ongoing awareness training is one of the most cost-effective defenses there is.
Keep the basics current: Patched devices, endpoint protection, and tested backups all limit the damage if something does slip through. Our 15 ways to protect your business from a cyber attack covers the fundamentals.
If Someone Clicks
It will happen eventually, so decide in advance how your team should respond. The rule is simple: report it right away, and don't try to clean it up quietly. Speed matters far more than embarrassment. The employee should tell IT immediately, change their password from a different device if they entered it on a suspicious page, and leave the email in place so it can be investigated. If you'd like to know what a real response looks like, see our guide to the first 24 hours after a cyberattack.
The Bottom Line
Holiday phishing works because it hides inside normal, busy, well-intentioned activity. You can't stop the messages from arriving, but you can make sure your people recognize them, your payment processes can't be hijacked by a single email, and your accounts are protected even when a password gets stolen. A little preparation now is far easier than recovering in January.