Holiday Scams That Target Small Business Offices

The weeks before the new year are some of the busiest of the year for a small office. Orders pile up, packages arrive, vendors send final invoices, and half the team is planning time off. Scammers know this. They count on people being rushed and distracted, so a fake message slips through.

The good news is that most holiday scams follow a small number of patterns. If your team knows them, and your office has a few simple rules, you can stop most of them.

Four scams to watch for

1. The "boss needs gift cards" request. An email or text appears to come from the owner or a manager. It says something like, "I'm in a meeting. Can you buy gift cards for clients and send me the codes?" The name looks right, but the sender's address is not. Real owners rarely ask for gift card codes by text.

2. Fake shipping notices. Offices receive a lot of deliveries in November and December. A message says a package is delayed or needs a new address, with a link to "fix it." The link leads to a fake sign-in page that steals your password. If you were not expecting a package, be extra careful. Even if you were, go to the carrier's website yourself instead of using the link.

3. Invoices with new bank details. A vendor you pay every month emails to say their bank account has changed. The next payment goes to a scammer. This one costs real money, and it often works because year-end payments are large and quick.

4. Fake year-end "document" shares. You get a message that looks like a shared file from Microsoft 365 or another service: "2026 bonus list" or "Year-end review." Curiosity makes people click. The link asks you to sign in, and that is how the thief gets your password.

Slow down on the three things scammers want

Almost every scam asks for one of three things: money, a password, or a click on a link. When a message asks for any of these and also says it is urgent, stop. Urgency is the scammer's main tool.

Ask yourself:

• Was I expecting this?
• Does the sender's full email address match what I know? (Tap or hover over the name to see it.)
• Is it asking me to do something I would not normally do?

If any answer feels off, do not reply to the message. Contact the person using a phone number or address you already have.

A short checklist for your office

Put these rules in writing and share them with everyone, including seasonal and part-time staff.

• Confirm payment changes by phone. If a vendor changes bank details, call them at a number you already had on file. Do not use the number in the email. Have a second person approve the change.
• No gift cards by email or text. Make it a rule that requests for gift cards, wire transfers or purchases must be confirmed in person or by phone.
• Go to the source. For package tracking, document shares and account alerts, open the website yourself instead of clicking a link.
• Turn on multi-factor sign-in. This means a second step, like a code on your phone, when you sign in. If a thief steals a password, they still cannot get in without that second step. Turn it on for email first.
• Keep devices updated. Install Windows and Microsoft 365 updates when they come up, not weeks later.
• Make it easy to report. Tell staff that reporting a suspicious message is always fine, even if they already clicked. A quick report helps. Hiding a mistake does not.

If someone already clicked

It happens to careful people. Act quickly and calmly:

1. Disconnect the computer from the network if the link downloaded anything.
2. Change the password for the account involved, from a different device if you can.
3. Tell your IT provider or whoever manages your computers right away.
4. If money was sent, call your bank immediately. Banks can sometimes stop or recall a payment if you reach them fast.
5. Check the mailbox for new forwarding rules, which are settings that quietly copy your email to someone else.

Before the holidays arrive

Take ten minutes this week. Share this list with your team. Check who can approve payments and confirm that the rule about calling vendors is clear. Make sure multi-factor sign-in is on for email.

If you are not sure what protection you have, Insation Technologies offers a free IT and security assessment. A technician reviews things like your backups, updates, multi-factor sign-in and email protection, then sends a plain-English report on what to fix first. You can request it at insationtech.com/assessment or call us at (508) 422-0477.

A few small habits now can keep the end of the year calm.