Protect Yourself from Holiday Scams

By Sharon McDowell, MMBB Business Liaison, Technical Trainer

The holidays are a time of generosity and giving, but for scammers, it’s a season of opportunity. As we shop for gifts, donate to charities, and book travel plans, cybercriminals ramp up their efforts to exploit the festive rush. From fake charity appeals to “too-good-to-be-true” deals, holiday fraud is becoming more sophisticated every year. Here’s what you need to know to protect your wallet and your peace of mind this season.

Where Holiday Scams Happen Most

Tools that holiday fraudsters use include:

Gift cards
Package delivery
Charity donations
Social Media

The most common way these scams are committed is through text messages. People tend to read them quickly, often while distracted, making them prime targets. Scammers use urgent, emotional language to pressure victims into acting without thinking.

The Cost of Text-Based Scams

According to the Federal Trade Commission, Americans lost $470 million in 2024 to scams that started with a text message. This is an increase of 26 percent over 2023 and five times higher than in 2020. These numbers represent a fraction of the losses, since most scams are not reported.¹

What do these fraudulent text messages look like during the holiday season? Two of the most common are gift cards and package delivery.

Gift Card Scams

Let’s say you receive an email or text from a friend or supervisor asking to buy multiple gift cards urgently. To confirm the request is legitimate, call the person at the phone number you have on file for them rather than the phone number in the text or email before acting.

Package Delivery Scams

These occur year-round but spike during the holidays when deliveries pile up. A text claims there’s an issue with your package and asks you to click on a link. That link may steal your personal identification or install malware.

Another variation includes messages claiming the item cannot be shipped because the company never received payment. A twist on this scam is a person leaving a physical note in a mailbox or on the door stating you missed a delivery with a number to call, which will lead to attempts to gather your personal information.

How to Spot Text/Email Fraud

With the growing number of daily cyberattacks, how can we protect ourselves? Cybersecurity is especially challenging when many scam messages appear to come from trusted corporations like Amazon, FedEx, UPS, Chase, and Bank of America.

Scam messages have four main components:

They usually claim to be from a well-known organization or company.
There is a problem, or a prize involved. In addition to the examples above, you may also be told you earned a reward, are getting a rebate, or someone wants to give you a gift card.
There is an urgency to the message with pressure to act immediately.
Payment is required or requested in a very specific way.

The first recommendation is to avoid reacting to the urgency of the call or message. Take a deep breath. Is a package scheduled for delivery? Check your records and find out. Monitor shipping progress for both packages being sent as well as being delivered. To discover if an account is truly locked, go to the account and see if you can log in. To really make sure, call the company’s official customer service number.

If these steps don’t fit the situation, carefully look at the company’s logo. Are the colors correct? Is the name spelled correctly? Check the URL. Is it a ".com" or something else? For example, well-known organizations’ URLs will not end with a ".me." Scammers buy domain names with the letters mixed up, such as "eBya.com" or a name somewhat like a real company’s name to fool viewers, such as "Arnazon.com." These fake domain names will sometimes come with a fake website that may look legitimate.

Pay attention to where the domain name is in the URL. The portion of the address directly preceding the “.com” should be the website you are visiting.

Still unsure if it’s real or not? Never provide any personal information. Don’t even text back to advise someone your number is the wrong number. Instead of clicking on a provided link or calling the number they suggest, go to your records and find the organization’s main number.

Other Types of Holiday Scams

Fraudsters often exploit people’s generosity during the holiday giving season, leading to a surge in charity donation scams. Before donating to any charity take time and research the organization to make sure it’s legitimate. Donate using a credit card so you can dispute the charge if you later find out it’s fraudulent.

Social media is often used for scams. Here are some common examples:

Misleading ads: A company may claim to sell the season’s hottest toy, but the product turns out to be a counterfeit. Another variation of this scam involves offering puppies or kittens that don’t exist.
Free trials: You sign up for a free trial, only to be charged for something completely different than what was advertised.
“Secret Santa” gift exchanges: This scam appears under various names and usually involves sending a gift in exchange for receiving one. Unfortunately, you may never get a gift, and you’ve just shared personal information with strangers.

Finally, be cautious when downloading holiday apps, especially free ones. While it may seem fun to watch Santa feed his reindeer or video chat with elves, these apps may contain malware. Always read reviews and verify the source before downloading.

Stay Vigilant This Holiday Season

The holidays should be a time of joy, not stress caused by scams. Cybercriminals count on distraction and urgency to trick people into acting without thinking. By slowing down, verifying requests, and using trusted sources, you can protect your finances and personal information. Remember: if something sounds too good to be true or feels rushed, it probably is. Stay alert, shop smart, and keep the season merry and safe.

Sharon McDowell serves as the business liaison and technical trainer at MMBB. She joined MMBB’s staff in 1992 and served on MMBB’s Help Desk team as a network analyst for more than 15 years. She is currently responsible for coordinating MMBB’s ongoing cybersecurity training. Her education includes a BS in computer science from State University of New York, College at New Paltz.