Holiday phishing scams are fake emails, texts and calls that borrow the look of shipping notices, gift card requests and year-end invoices. You can spot most of them by checking three things: the sender, the urgency and the ask. Here is a calm, practical guide for NYC offices.
What are the most common holiday phishing scams?
The most common scams copy things your team already expects in December: package updates, invoices, e-cards and requests from the boss. They work because everyone is busy and inboxes are full.
Here are the usual suspects:
- Fake delivery notices: a message says a package is delayed and asks you to confirm your address or pay a small fee.
- Gift card requests: a message that looks like it is from your boss asks you to buy gift cards “for clients” and send the codes.
- Year-end invoice fraud: a bill arrives from a vendor you recognize, but with new bank details.
- Shared document links: a “bonus schedule” or “holiday party photos” file asks you to sign in.
- Charity appeals: a donation request appears from an organization you have never heard of.
None of these are new. They just get a seasonal costume.
Why do phishing emails increase around the holidays?
Attackers know that people are rushed, distracted and expecting more messages than usual. As a result, a fake delivery notice looks normal in December, when it might look odd in March.
Manhattan offices also feel this in a specific way. Staff are ordering gifts, clients are sending year-end paperwork, and several people are out of the office. When the usual approver is away, a rushed request is more likely to slip through. That is a human problem, not a technical one, which is why calm habits work well.
How can you spot a phishing email? A quick red flag checklist
You can spot most phishing attempts by pausing and checking a short list of red flags before you click or reply. Here is one your team can keep handy:
- Check the real sender address. The display name can say anything. Look at the actual address behind it.
- Look for manufactured urgency. “Act within one hour” is a nudge to skip your thinking.
- Hover before you click. On a computer, hovering over a link shows where it really goes.
- Question unexpected attachments. If you did not expect it, ask the sender through another channel.
- Be wary of payment changes. New bank details or gift card requests deserve a phone call to a number you already have.
- Notice odd wording. Strange phrasing, tone or timing from a familiar person is worth a second look.
No single flag proves anything. However, two or three together are a good reason to stop and verify.
What should you do if someone clicks a suspicious link?
Tell someone right away. Speed matters far more than embarrassment, and a quick report is always better than a quiet hope that nothing happened.
Here is a simple sequence to share with your team:
- Do not enter any more information on the page.
- Report it to your IT provider or internal contact immediately.
- If you typed a password, change it from a trusted device and let IT know which account it was.
- Keep the message. Do not delete it, since it helps your IT team understand what happened.
Make it clear that reporting is welcome and never punished. People who fear blame stay quiet, and that is when small problems grow.
How can a small office prepare for holiday phishing scams?
A small office can prepare by agreeing on a few simple rules and making sure its tools back them up. You do not need a big program. You need habits that people actually follow.
Start with a standing rule: any request involving money, gift cards or changed bank details gets confirmed by phone. Then make sure multi-factor authentication is turned on for email and key apps. Keep software updated, and decide in advance who approves payments when someone is away.
Tools help too. Email filtering, endpoint protection and sensible Microsoft 365 settings catch a lot before it reaches anyone. At Haber Group, this sits within our reactive support, proactive care and strategic guidance, including cybersecurity and Microsoft 365 support.
One more modern wrinkle: people now paste emails and documents into AI tools to summarize them. That is fine with clear guardrails, which is the idea behind our Bring Your Own AI approach. If you want to set those guardrails, see our page on AI governance for small business in NYC.
Frequently asked questions
Are text messages and phone calls part of holiday scams too?
Yes. Scammers use texts and calls for fake delivery alerts, bank warnings and urgent requests that seem to come from a colleague. The same rules apply: slow down, do not use the contact details in the message, and verify through a number you already trust.
Should we run a phishing reminder for staff before the holidays?
A short, friendly reminder is a good idea. Share the checklist above, name the current scam types, and remind people who to contact. Five minutes in a team meeting often does more than a long document nobody reads.
Is it safe to open an email that looks like it is from the boss?
Opening is usually fine. Acting on an unusual request is where the risk sits. If the message asks for money, codes or sensitive files, confirm it with your boss by phone or in person first.
Talk to a team with no ego
If you would like a second pair of eyes on your setup, we are happy to talk. Get in touch with Haber Group and we will keep it friendly and practical. If you are curious about how your team uses AI tools, our free Shadow AI assessment is a good place to start. Shadow AI simply means AI tools staff use without the company knowing.
We have supported New York businesses for 25+ years, and we will always act promptly with your best interests in mind.
Previous Post
