Five festive phishing tricks to watch out for this Christmas

Why phishing attacks increase during the holidays 

Ransomware attacks increase by 30% during the holidays. But why is there such an increase? Online shopping activity is at its highest, which makes fake delivery notifications a common tactic. Scammers also take advantage of people’s generosity, sending fraudulent charity appeals. End-of-year urgency in business or personal accounts, such as fake invoices or account alerts, can trick recipients into acting without verifying the source. 

Common holiday phishing scams

During the festive season, cyber criminals often tailor their attacks to take advantage of seasonal behaviours. Here are the scams you are most likely to encounter:

Fake delivery notifications
Scammers frequently send emails or text messages claiming to be from well-known delivery companies or online retailers. These messages might alert you about a missed delivery or a package that requires urgent action. The goal is to trick you into clicking a link that either installs malware or steals your personal information. Always check the sender’s email address and verify delivery details directly with the official website.

Online shopping scams
With the surge in online shopping, fake e-commerce sites or adverts offering “too-good-to-be-true” deals become common. These sites often mimic legitimate retailers, advertising through Google shopping ads and Facebook ads to seem more legitimate. Only shop through trusted websites, and double-check URLs carefully before making any payment.

Fraudulent charity appeals
Charity donations tend to rise during the holiday season, which makes this a prime target for scammers. Fake appeals may use names similar to real charities, include convincing logos, or create a sense of urgency. Always verify the charity’s legitimacy before donating and consider donating directly through official websites rather than links in emails.

Holiday-themed emails and e-cards
Scammers may send festive greetings, digital cards, or “holiday offers” containing malicious links or attachments. While these messages may appear friendly or festive, opening an attachment or clicking a link could compromise your device. When in doubt, avoid opening unsolicited attachments and confirm the sender before interacting with the message.

Account suspension or urgent security alerts
Some cyber criminals send messages claiming your account has been suspended, compromised, or at risk, urging immediate action. These emails often appear to come from well-known services such as online retailers, banks, or subscription platforms. They exploit fear and urgency to get you to reveal passwords or other sensitive information. Always access your accounts directly via official websites rather than through email links.

How to protect yourself

Here are practical steps to stay safe online this festive season:

1. Verify the sender: check the email address carefully; scammers often use addresses that look similar to legitimate companies
2. Hover over links: make sure URLs match the official website before clicking
3. Avoid urgent requests: be suspicious of messages that pressure you to act quickly
4. Use multi-factor authentication (MFA): adds an extra layer of security to your accounts
5. Keep software updated: ensure your devices and antivirus software are up to date to block potential threats
6. Educate your team: for organisations, remind employees about phishing attacks and encourage vigilance