Why the holiday season is a high-risk time

The end of the year, from Thanksgiving through January 1st, is frantic for everyone. We're juggling shopping lists, travel plans, and year-end deadlines. That distraction is exactly what cybercriminals count on.

Fraud operations are starting earlier than ever, using advanced tools like Generative AI to make their fake emails and ads look incredibly real. The threat is universal, touching everything from your personal shopping to your professional email. Being busy shouldn't mean being vulnerable.

The 5 Most Common Holiday Scams to Watch Out For

1. Fake "Too Good to Be True" Deals & Phony Stores

If you see a 90% discount on a popular item, your alarm should go off. Scammers create slick, but fake, retail websites and ads that copy big-brand logos. Once you enter your payment details, they steal your money and your credit card information.

What you should do:

• Verify the URL: Before clicking a link in an email or social media ad, hover your mouse over it (or press and hold on mobile) to see the full web address. It should match the known brand name exactly.
• Buy Direct: If a deal looks amazing, go directly to the retailer’s official website by typing the address yourself, then search for the deal there.
• Use Buyer Protection: Always use a credit card or a protected payment service like PayPal, as they offer better fraud protection than debit cards.

2. Password Reuse and Account Takeover (ATO)

Do you use the same password for your Netflix account, your shopping account, and your work email? That's a huge risk. If a shopping site is hacked, those stolen passwords are used to try and log into every other account you own—including your sensitive work accounts.

What you should do:

• Enable Multi-Factor Authentication (MFA): This is the single most important step. Use MFA on every service possible (email, banking, shopping, and work systems). It prevents a thief from logging in even if they have your password.
• Use a Password Manager: Get a tool like 1Password to create and store unique, strong passwords for every single site.
• Keep Work and Home Separate: Never use your work email or password for personal shopping or entertainment.

3. Delivery Fee Phishing and Smishing

The packages are delayed! Or are they? Scammers exploit the volume of holiday shipments by sending urgent-sounding texts (smishing) or emails (phishing) that claim your package is delayed, or that you owe a small "redelivery fee" to get it moving.

What you should do:

• Don't Click Unexpected Links: The safest rule is to never click a tracking link in an email or text you didn't specifically request.
• Check Independently: If you're worried about a delivery, go directly to the carrier's official website (like UPS or FedEx) and enter your official tracking number there.

4. Gift Card and Urgent Payment Scams

Gift cards are essentially cash, and criminals know it. Common scams include receiving an email that looks like it's from a manager, client, or even a friend asking you to immediately buy gift cards to cover an “urgent expense” or to get a “refund” or even “as last minute gifts for the office staff.”

What you should do:

• Never Pay with Gift Cards: Legitimate businesses (like the IRS or banks) will never demand payment in the form of gift cards or cryptocurrency.
• Verify the Request: If someone asks you to buy gift cards, call them on a known, verified phone number to confirm the request before you purchase anything. Do not reply to the email.

5. Early Attacks and General Distraction

Fraudsters aren't waiting for Black Friday; they are testing and launching campaigns now. The holiday season just compounds the general distraction that makes us all click on things we shouldn't.

What you should do:

• Slow Down: When you are at work or handling personal finances, take a deep breath before clicking anything. A moment of caution is worth avoiding days of cleanup.
• Review Your Devices: Make sure the security software (anti-virus/endpoint protection) on your home computer and your work laptop is up to date and running properly.

Quick-Action Checklist for a Safer Season

• MFA Everywhere: Enable Multi-Factor Authentication on your email, bank accounts, and primary social media.
• Unique Passwords: Stop reusing passwords. Start using a password manager today.
• No Shopping at Work: Avoid using work devices or the corporate network for personal holiday shopping, as this can introduce risks into your employer's systems.
• Verify Links: Get in the habit of hovering over links before clicking. Look for spelling errors or strange domains in email addresses.
• Update Everything: Make sure your phone, computer, and all applications have the latest security patches and updates installed.

A little preparation now can ensure you spend the holidays relaxing, not worrying about a compromised account. Stay safe and enjoy the season!