The short version for owners and office managers: December is when payment fraud works best. Everyone is busy, vendors are sending real invoices, and the boss really is out of the office half the time. Every scam below ends the same way, with someone moving money or reading off gift card codes after a message they never verified. One rule stops most of it. No payment detail changes and no gift card purchases without a phone call to a number you already had on file.

Here is what the holiday versions look like right now, how to shut each one down, and exactly what to do in the first hour if money already left the account.

Why the Holidays Are Peak Season

The FBI’s 2025 Internet Crime Report puts business email compromise at $3,046,598,558 in reported losses for 2025, second only to investment fraud among cyber-enabled fraud types. Washington ranked 11th in the country, with 25,619 complaints and $458,165,375 in reported losses. Those are only the incidents people reported.

The fourth quarter stacks the odds for attackers. Vendors push invoices before year-end, accounting runs extra payment batches, people buy gift cards for clients and staff, and schedules are full of PTO. A strange request that would get questioned in March slides through in mid-December because it looks like everything else on the desk.

The Boss Wants Gift Cards

This one starts with a text from an unknown number that claims to be the owner or a manager. They are stuck in a meeting, they need gift cards for client gifts, and could you grab a few, scratch off the backs, and text photos of the codes. It is fast, it plays on wanting to help, and it works on smart people every year.

The FTC is blunt about this: only scammers ask for gift card numbers and PINs. Once the codes are sent, the balance can be drained in minutes. The FTC’s advice if it already happened is to contact the gift card company right away, keep the card and the receipt, and report it at ReportFraud.ftc.gov.

What stops it. Put it in writing before December: leadership never asks anyone to buy gift cards by text or email. When the policy exists, the employee who gets the text has permission to ignore it instead of worrying they are letting the boss down.

Fake Invoices and Bank Detail Changes

This is business email compromise, and the IC3 describes it as a scam carried out by compromising legitimate business email accounts through social engineering or intrusion, ending in an unauthorized transfer of funds. It shows up two ways. The easy one to spot comes from a lookalike domain, one letter off from your real vendor. The hard one comes from your real vendor’s actual mailbox after someone broke into it, replying inside an existing thread with the right names, the right invoice numbers, and a note that their bank details changed.

Red flags are consistent: new routing or account numbers, pressure to pay today, a request to keep it quiet, or a sudden switch to a personal email or text. Payroll gets its own version, where an "employee" emails HR asking to update their direct deposit before the next pay run.

What stops it. The IC3 tells businesses to use secondary channels to verify any request to change account information. In practice that means calling the vendor at a number from your own records, never the one in the email, before any new bank detail gets entered. Add dual approval for new payees and changed bank details so no single person can move money on an email alone. The IC3 also calls out checking the full sender address, especially on phones, where the mail app shows only a display name.

Fake Delivery and Shipping Notices

Holiday shipping volume makes "missed delivery" messages believable. The text or email links to a page that asks for a small redelivery fee or a Microsoft 365 sign-in to "view the shipping label". CISA’s phishing guidance lists the signs that matter here: urgent language, untrusted shortened links, and addresses that are almost right, like amazan.com. CISA also points out that bad grammar is no longer a reliable tell, because AI writes clean copy.

What stops it. Never track a package from a link in a message. Type the carrier’s address into the browser or open the app you already use, and check the tracking number there.

Charity Appeals and Year-End Bonus Phishing

Giving season brings fake charity appeals, and the IC3 now tracks charity fraud as its own category, with $7,907,609 in reported losses in 2025. If the business wants to donate, go to the charity’s own website directly rather than clicking a link from an email.

The internal version is the bonus lure: "Your year-end bonus statement is ready" with a link to a fake Microsoft sign-in page. It works because people want it to be true. A stolen password plus a tired employee approving an MFA prompt is how many mailbox takeovers start, which is exactly the pattern in our post on MFA fatigue and push bombing. Number matching on MFA prompts and conditional access policies close most of that gap.

QR Codes in Email and on Paper

A QR code hides the link, so the usual "hover before you click" habit does nothing. The FBI’s warning on tampered QR codes boils down to a few habits: check the address after scanning, be careful entering a login or payment details on any site you reached from a QR code, look for stickers placed over the original code on printed material, never install an app from a QR code, and use the phone’s built-in camera scanner instead of a third-party scanner app. A QR code in an email asking you to "re-verify MFA" is a phishing attempt every time.

Turn On External Sender Tags in Microsoft 365

A text that claims to be the owner is hard to filter. An email that claims to be the owner but comes from outside your tenant is easy, if Outlook tells people. Exchange Online can mark every message from outside your organization with an External tag near the subject line. One command turns it on for the whole tenant:

Connect-ExchangeOnline
Set-ExternalInOutlook -Enabled $true

# Confirm the setting
Get-ExternalInOutlook

Per Microsoft’s documentation, it can take 24 to 48 hours for the tag to show up in supported versions of Outlook. There is an AllowList parameter to exempt trusted partner domains. Use it sparingly, because a compromised partner mailbox is exactly the case where you want the tag showing.

If Money Already Moved

Call your bank first. Before anything else. The IC3 says to contact the originating bank as soon as the fraud is recognized and ask for a recall or reversal, plus a Hold Harmless Letter or Letter of Indemnity. Speed is the whole game here. In 2025 the IC3 Recovery Asset Team worked 3,900 incidents through its Financial Fraud Kill Chain and froze $679,013,183, a 58 percent success rate, and its guidance is that time is of the essence.

File with the IC3. Submit a detailed complaint at complaint.ic3.gov and include the banking details, since that is what lets the team request a freeze. Be ready for the follow-up scam: the IC3 states it never contacts victims directly and does not work with private recovery firms, so anyone calling to offer to get your money back for a fee is the second wave.

Lock down the mailbox. If a staff mailbox was compromised, reset the password, sign the user out of every session, and check for inbox rules. Attackers love a quiet rule that forwards or hides replies from the real vendor, which keeps the fraud running after you reset the password.

# Look for rules that forward, redirect, or delete mail
Get-InboxRule -Mailbox 'user@yourdomain.com' |
  Select-Object Name, Enabled, ForwardTo, RedirectTo, DeleteMessage, MoveToFolder

A Note for Seattle and Tacoma Businesses

Washington’s 11th-place ranking for losses includes plenty of small offices. A business with one bookkeeper, an owner who travels, and one shared inbox that handles invoices is exactly the setup these scams are built to exploit. If that sounds like you, the callback rule and dual approval cost nothing and work immediately. For help setting up external tagging, MFA, and mailbox monitoring, our Seattle IT support and Tacoma IT support teams do this work every week.

References

Want payment fraud controls and Microsoft 365 hardening set up before the holiday rush? Contact Rain City Techworks.