Holiday Season Scams Targeting Small Business

Holiday season is good for sales and bad for security — the same November-to-December rush that drives revenue also drives a predictable spike in scams aimed specifically at small businesses, not just holiday shoppers. Vendor invoice fraud, executive impersonation, and seasonal-hire scams all lean on the same thing: a busy, distracted team and executives who are harder to reach for a quick verification call.

Why the Holidays Are a Bigger Risk Window

Three things stack up at once during the holidays: end-of-year invoice volume is higher as businesses close out budgets and pay year-end bills, key decision-makers are more likely to be traveling or out of office and reachable mainly by email, and new seasonal or temporary staff are onboarding without the full security training a longer-tenured employee has absorbed. Attackers know all three of these are predictable and time their campaigns accordingly — holiday-season fraud attempts aren’t random, they’re scheduled around exactly this stretch of the calendar.

Vendor Invoice Fraud

This is one of the most financially damaging holiday-season scams and one of the hardest to catch, because it impersonates a real supplier you already do business with rather than a stranger. The attacker, usually after compromising a vendor’s email account or spoofing their domain, sends an invoice that looks legitimate — same vendor name, similar formatting, a plausible amount — but with updated payment or bank routing details. Because year-end closing often means paying several real invoices in a short window, a fraudulent one can slip through if accounts payable doesn’t independently verify any change in payment details, especially with the vendor’s actual accounts team using a phone number you already have on file, not one listed in the suspicious email itself.

Executive Impersonation and Gift Card Requests

A classic variant sees an attacker spoof or closely mimic an executive’s email — “Are you at your desk? I need something handled before the holiday” — then follow up with an urgent request, often for gift cards, wire transfers, or sensitive data, while the real executive is traveling or out of office and harder to reach for a quick confirmation. The urgency and the executive’s actual unavailability are both doing work for the attacker here; the scam specifically exploits the fact that December calendars are full of out-of-office executives and holiday travel, making a two-minute verification call less likely to happen before someone acts on the request.

Seasonal Hiring Scams

Holiday retail and fulfillment surges often mean bringing on temporary staff fast, and that speed creates its own opening: fake job applications using stolen identities to get hired and gain system access, phishing onboarding portals built to look like your real HR system but designed to capture new-hire W-2 and direct-deposit information, and overpayment or fake-check scams where a “new hire” is sent an inflated paycheck and asked to wire back the difference. Vet seasonal hires with the same identity verification rigor as permanent staff, and make sure your actual onboarding portal has a recognizable, consistent URL that new employees are told about in advance — not one they’re expected to find via a link in an email.

Shipping and Delivery Notification Phishing

With package volume at its highest point of the year, fake shipping and delivery notifications are everywhere — and they target employees at work just as much as they target consumers at home, especially when a business expects a lot of holiday shipments itself (inventory, gifts for clients, supplies). A fake “delivery exception, click to reschedule” text or email is a reliable credential-phishing and malware-delivery vector precisely because it’s plausible for almost anyone to be expecting a package this time of year.

Checkout Fraud During Peak E-Commerce Traffic

If your business runs its own online store, the holiday traffic surge is also cover for card testing (automated attempts to validate stolen card numbers through small transactions) and account takeover attempts, since fraudulent activity is harder to spot against a much larger volume of legitimate holiday orders. This is the same season where formjacking-style card-skimming attacks are most lucrative for an attacker, precisely because there’s more real transaction volume for a hidden skimmer to blend into.

What Actually Reduces Risk During This Window

Require a callback to a known, on-file phone number — never a number listed in the suspicious message itself — before processing any changed payment or banking detail, no matter how legitimate the email looks or how time-pressured the request seems. Set an internal rule that no gift card, wire transfer, or unusual payment request gets processed from an email alone, holiday season or not, regardless of who it appears to be from. Brief your team specifically before the holiday rush that scam volume increases this time of year, rather than assuming your general year-round security training already covers it — a timed reminder right before the season starts measurably improves how carefully people check before acting.

Setting Expectations With Vendors and Partners Before the Rush

A short note to your regular vendors and partners before the season starts — reminding them that you’ll independently verify any changed payment or banking detail by phone before processing it, and asking them to flag you directly if they notice anything odd coming from your side — closes off a surprising amount of risk for very little effort. Many vendor invoice frauds succeed specifically because neither side has ever discussed what a legitimate request from the other actually looks like, which leaves both parties guessing when something unusual arrives. This is also a good moment to confirm your own accounts-payable contact list is current, since a callback to an outdated number defeats the purpose of having a verification step at all.

Scale of the Broader Problem

Context for how large this threat category has gotten overall: the FBI’s Internet Crime Complaint Center recorded $16.6 billion in reported losses in 2024, up 33% year over year, and the FTC’s Consumer Sentinel Network reported $12 billion in losses the same year, with impersonation scams the single largest reported category. Those figures span all of cybercrime, not holiday-specific business fraud alone, but they illustrate the scale of the broader environment this seasonal spike sits inside.

Bottom Line

Holiday-season fraud against small businesses isn’t random — it specifically targets the predictable combination of high invoice volume, hard-to-reach decision-makers, and fast seasonal hiring that defines this time of year. A mandatory callback rule for any changed payment detail, a no-gift-card-from-email policy, and a timed reminder to your team before the rush starts are low-cost controls that close most of this window.