Every December, the volume of Christmas-themed scam emails and texts rises sharply, for a simple reason: the season gives attackers a believable excuse for messages that would otherwise look suspicious the rest of the year. Knowing the common patterns in advance is genuinely most of the defence against them.
Fake delivery notifications
With genuine parcel deliveries at their highest volume of the year, a fake "missed delivery" or "customs fee owed" text or email blends in easily. These typically link to a convincing but fake courier page asking for a small payment or personal details. If in doubt, go directly to the courier's official website or app rather than clicking the link in the message.
Fake charity appeals
Genuine charitable giving also rises at Christmas, and scammers know it. Fake charity emails, often referencing real, well-known causes, ask for donations through a link rather than the charity's actual website. If you want to donate, go directly to the charity's known website rather than through a link in an unsolicited email.
Fake year-end "deals" and invoices
A flood of genuine Christmas sales emails makes it easier for a fake "huge discount" or urgent "your order couldn't be processed" email to slip through unnoticed. Similarly, with many businesses rushing to close out invoices before year-end, a fake invoice or payment-details-change email can be more easily mistaken for a genuine, time-pressured request.
Gift card and voucher scams
A particularly common business-targeted version asks an employee, apparently from a director or manager, to urgently buy gift cards or vouchers "for staff" — timed deliberately for when that person is likely away from the office and harder to reach to verify by phone.
Why Christmas specifically increases the risk
The combination of genuinely higher email volume, skeleton staffing, people being distracted or rushing before the break, and a plausible excuse for almost any request, makes December a particularly effective time for these attempts — which is exactly why they spike every single year rather than being a one-off trend.
The same basic defence works here as always
Verify anything involving payment, personal details, or an urgent request through a separate channel you already trust, rather than the one the message arrived on — and if your team hasn't had phishing awareness training recently, this is a good time of year to make sure they have.
If you'd like help making sure your email filtering and staff awareness are properly set up before the Christmas rush, our cyber security page covers how we can help, or get in touch.
Talk to a local IT team
Get in touch and we'll talk you through how we can help — no pressure, no jargon.