A Holiday Scam Briefing for Your Staff

The holidays bring more packages, more year-end invoices, more people out of the office, and more rushed decisions. Scammers know it. This post is a short briefing you can read aloud at your next team huddle, forward as an email, or print for the break room.

Why brief staff before the holidays?

Most scams work because someone is busy and wants to be helpful. Around the holidays, everyone is both. A few minutes of plain talk now gives your team permission to slow down and check, which is the single habit that stops most of these tricks. If you want ongoing training, see our guide to phishing training for employees.

The briefing (read this to your team)

1. "Your package couldn't be delivered." Texts and emails about missed deliveries are everywhere this time of year. Don't tap the link. If you're expecting something, open the shipper's app or type their website in yourself.

Printed codes are a newer twist on the same trick. See our guide to QR code phishing.

2. "Can you grab some gift cards for me?" A message that looks like it's from the owner or a manager asks you to buy gift cards for clients or staff and send the codes. Real managers don't do this by text or email. Call them at the number you already have.

3. "We've updated our bank details." Year-end is when vendors send final invoices, and when fake "new bank account" notices show up. Never change payment details based on an email. Confirm by phone, using a number from your records, not the one in the message. More on this in our post on stopping wire fraud.

4. "This is IT. We need to fix your account." With people out, a call or Teams message from "the help desk" feels normal. Our IT team will never ask for your password or a sign-in code. Hang up and call us back. Here's how fake help-desk calls usually play out.

5. "Holiday bonus" or "year-end HR document" emails. Attachments and links promising a bonus, a schedule or a benefits form are a favorite lure. If you weren't expecting it, check with HR or your manager first.

What should staff do if something looks wrong?

• Stop. Don't click, reply or pay.

• Report it to your manager or IT provider right away, even if you already clicked. Fast reporting matters more than being embarrassed.

• Don't forward a suspicious email to coworkers to "ask what they think."

One rule to remember

If a message is urgent, involves money, codes or passwords, and arrives in an unusual way, check it through a second channel you already trust.

How 24uNet helps

We give teams short, practical security training and set up the protections in our Security Baseline so fewer of these messages reach inboxes in the first place. If you'd like help preparing your team, contact us.

Frequently asked questions

What is the most common holiday scam at work?

Fake delivery notices and gift card requests that pretend to come from a manager are among the most common.

Should staff report a scam even if they didn't click?

Yes. Reports help your IT provider block the same message for everyone else.

What if someone already clicked or paid?

Tell your IT provider and your bank right away. The sooner they know, the more they can do.

Can our IT provider block these messages?

Many can be filtered, but some always get through. That's why a quick staff briefing still matters.