Every November and December, the same pattern shows up in BC business inboxes. Staff are busy, managers are away, suppliers are rushing to close the year, and everyone is buying, shipping and donating more than usual. Criminals know this. They do not need new tricks. They take the old ones and dress them up for the season, because a rushed person checks less.

This article walks through the five holiday scams we see most often against small and mid-sized businesses, what each one looks like, and the one habit that defeats all of them: verify the request through a channel you already trust, not the one the message gave you.

If money has already left your account: call your bank first, then report it to the Canadian Anti-Fraud Centre (CAFC) and your local police. Speed matters with wire and e-transfer recovery. Our article on CEO fraud and wire transfer recovery covers the first hours in detail.

1. Gift card requests "from the boss"

An employee gets a short email or text that appears to come from the owner or a senior manager. The message says the sender is in a meeting or travelling, and asks the employee to buy gift cards for staff rewards or client gifts, scratch off the backs and send photos of the codes. The CAFC describes this exact variation of the business executive spoof: the boss is "offsite" and needs gift cards for employee rewards or birthday gifts.

The holiday season makes it believable. Owners really do buy gifts for staff in December, and nobody wants to ask the boss too many questions.

Warning signs: a personal email address or a new phone number, a request for secrecy ("I want it to be a surprise"), pressure to act within the hour, and any request to send card numbers or photos of the backs of cards. The CAFC is clear that legitimate businesses will not ask you to pay with gift cards, especially under pressure.

What protects you: a simple written rule that the business never asks staff to buy gift cards by email or text, and that any such request is confirmed by calling the person on the number in your staff directory.

2. Fake courier and delivery texts

With more parcels moving than at any other time of year, a text that says "your package is on hold, update your address" or "a small redelivery fee is due" feels routine. The link leads to a convincing copy of a courier or postal site that collects card details, or a login page that collects passwords. The CAFC warns that these messages often claim incomplete shipping details, a failed delivery or a held package that requires payment.

At work, the risk is larger than a stolen card number. If someone enters their work email password on that fake page, the attacker may now have access to your mailbox, your files and your contacts.

What protects you: never pay or sign in from a link in an unexpected delivery text. Open the courier's app or type the courier's website address yourself and enter the tracking number there. If the tracking number is not in the courier's system, the message was fake.

3. Invoice and payment-change fraud

This is the most expensive scam on the list. A supplier, contractor or landlord appears to email you with new banking details, often with a reason that sounds sensible at year end: "we changed banks", "our old account is being audited", "please use this account for the December invoice." The CAFC calls this a supplier or contractor swindle. A close cousin is the payroll spoof, where someone posing as an employee asks to change their direct deposit account before the holiday pay run.

These emails are often sent from a real account that was taken over, or from an address one letter away from the real one. Our article on supplier lookalike email takeover shows how convincing they can be.

Step 1

Stop

Treat every request to change banking details as suspicious until it is confirmed, no matter who it appears to come from or how urgent it sounds.

Step 2

Call a number you already have

Phone the supplier or employee on the number in your accounting system, your contract or your staff directory. Never use a phone number from the email that asked for the change.

Step 3

Record and hold

Write down who confirmed the change, when and on what number. If you cannot reach anyone, keep paying the old account or hold the payment. A late payment can be fixed. A payment to a criminal often cannot.

4. Fake charity appeals

Businesses give generously at the end of the year, and scammers copy real charities, invent new ones or create fake crowdfunding pages tied to news events. The appeal may arrive by email, phone, text or social media, and it often pushes for an immediate donation.

The CAFC's advice is practical: ask for the charity's registered charitable tax number and confirm it on the Canada Revenue Agency (CRA) List of Charities, give directly through the organization's own website where possible, and be wary of high-pressure tactics. The CAFC also notes that registered charities do not accept cryptocurrency as a payment method, so any appeal that asks for it should be treated as a red flag.

What protects you: one person approves business donations, every charity is checked on the CRA list before money is sent, and donations go through the charity's own website, never through a link in an unexpected message.

5. Travel booking and prize lures

Staff booking holiday travel, and businesses booking year-end events, are targets for fake booking sites, fake "free trip" prizes and fake airline offers. The CAFC describes vacation scams where fraudsters impersonate well-known airlines and travel companies, announce a free or discounted trip, then ask for personal information and a deposit to hold the booking. The CAFC also points out that if you did not enter a contest, you cannot win it.

A related seasonal trap is the fake toll or fine text, which claims you owe money and must pay through a link right away. The CAFC notes that genuine toll agencies will not demand immediate payment by text message.

What protects you: book business travel only through sites you type in yourself or through your usual travel agent, never pay a "deposit" to claim a prize, and treat any message that creates urgency around money as suspicious.

Why these scams work in December

None of these scams rely on clever technology. They rely on timing and on people. Three things make the holidays risky:

  • People are away. When the owner or the bookkeeper is on holiday, a request "from" them is harder to check, and staff covering for them may not know the normal process.
  • Volume hides fakes. More invoices, more parcels and more donation requests mean a fake one blends in.
  • Goodwill lowers guard. People want to help a busy boss, a struggling charity or a supplier closing the year. Scammers write messages that play on exactly that.

A holiday checklist for your staff

Print this, share it at your next team meeting, or pin it in your team chat. It works for all five scams above.

Staff checklist: before you click, pay or buy

  • We never buy gift cards because of an email or text. Call the person on the number in the staff directory.
  • Banking detail changes are confirmed by phone on a number we already have, and the call is recorded in writing.
  • Delivery problems are checked in the courier's own app or website, never through a link in a text.
  • Charities are checked on the CRA List of Charities, and donations go through the charity's own website.
  • Travel is booked only on sites we type in ourselves. No deposits to claim prizes.
  • Urgency, secrecy or a new payment method is a reason to slow down, not speed up.
  • If you clicked or paid, tell your manager and IT right away. Nobody gets in trouble for reporting quickly.

If someone already clicked or paid

Mistakes happen, and the first hour is what counts. If a staff member entered a password on a fake page, follow the steps in our article on what to do after clicking a phishing link: change the password from another device, sign out all sessions and check for new inbox rules. If money was sent, call the bank immediately and ask about a recall, then report it to the CAFC and police.

If customer or employee personal information may have been exposed, there may also be privacy obligations. Under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), organizations must report breaches that create a real risk of significant harm. Our PIPEDA breach notification playbook explains how to assess that.

One habit beats all five scams. Confirm any request involving money, gift cards, passwords or banking details through a channel you already trust: a known phone number, an app you opened yourself, or a face-to-face conversation. Never use the contact details inside the message that is asking.

Make it part of the routine

A short reminder in late November, before the holiday rush, does more than a long training session in March. Pair the checklist above with security awareness training and multi-factor authentication (MFA) on every email account, so a stolen password alone is not enough for an attacker to get in.

Want Your Team Ready Before the Holiday Rush?

Hexafusion helps Vancouver and Lower Mainland businesses put simple payment checks, staff training and email protection in place. Call us at 604-332-1500 or send us a message, and we will talk through what fits your team.

Contact Hexafusion    604-332-1500

Related articles: CEO Fraud and Wire Transfer Recovery · I Clicked a Phishing Link: What to Do · Supplier Lookalike Email Takeover

← Back to Blog