Black Friday and Christmas scams aimed at small businesses: what to watch for in 2026

The scams that spike between Black Friday and Christmas are fake parcel delivery texts and emails, too-good-to-be-true deals, fake charity appeals, and, for businesses, fake supplier bank changes, gift-card requests that seem to come from the boss, and fake bonus or party emails that lead to a stolen login. They work because they look like the genuine messages everyone is expecting at this time of year. The fix is a short team briefing in November and one habit: never act on the link, number or bank details inside the message.

Why do scams spike between Black Friday and Christmas?

Scams spike at Christmas because criminals copy whatever people are already expecting, and in late November and December that's a lot. This year Black Friday falls on Friday 27 November 2026 and Cyber Monday on 30 November. From then on, most people are tracking parcels, scanning offers, chasing year-end invoices and replying to party invites.

For a small team, three things change at once. Inboxes and phones are fuller, so each message gets less attention. People order personal parcels to the office, so “we missed your delivery” is believable at work. And as people take leave, the person who would normally say “hang on, that's odd” may not be there.

How do fake parcel delivery texts work?

A fake parcel delivery text claims a delivery has failed or is on hold, and asks you to pay a small fee or confirm your details through a link. The fee is tiny so you don't think twice. The real target is your card details, which the fake page collects and which are then used or sold. A follow-up call from “the bank's fraud team” can come next, using what was stolen to sound convincing.

This is smishing, and it arrives on personal phones. That still matters to the business: many people read work email on the same phone, use a work card for office orders, or reuse passwords between shopping accounts and work.

The one check: open the shop's website or app where you placed the order and track it from there. If you didn't order anything, you can ignore it. The same pattern turns up by email, and as fake “sorry we missed you” cards pushed through the office door with a QR code to scan. A code on a card is still a link, so treat it the same way; see how quishing works.

What Christmas scams target the business itself?

The Christmas scams that cost a small business most are the quiet ones that ask someone to pay, buy or sign in, using the season as cover. These usually arrive by email and are aimed at whoever handles money, orders or staff admin.

“We're closing for Christmas: new bank details”

An email that seems to come from a supplier says their office closes over Christmas and asks you to pay outstanding invoices into a “holding” or new account before the break. It may come from a lookalike address, or from the supplier's real mailbox after it's been taken over. This is invoice fraud and payment diversion, and year-end is a favourite time for it because lots of invoices get paid at once.

Gift cards for “client thank-yous”

A message that looks like it's from the owner or a manager says they're stuck in meetings and need gift cards bought for clients or the team. They ask you to scratch off the codes and send photos. It feels like a normal festive errand, which is the point. Once the codes are sent, the money is gone.

E-cards, party invites and the “Christmas rota”

“You've received an e-card”, “Christmas party: please RSVP” or “Christmas cover rota 2026 shared with you”. The link leads to a fake sign-in page that looks like your email or file-sharing login, or the attachment asks you to enable something to view it. Either way, the goal is your work password.

Christmas bonus and payroll emails

“Your Christmas bonus letter is ready” or “Confirm your bank details before the December payroll run”. Everyone wants to open these. They lead to a fake HR or payroll login, or ask staff to “update” the account their pay goes into. Some aim at the person who runs payroll, posing as an employee asking to change their bank details before payday.

Black Friday deals on equipment

Laptops, monitors, printers and software licences at prices well below anywhere else, from a shop you've never heard of or a link in an ad. Some are fake sites that take payment and send nothing. Some ask for a bank transfer “to secure the discount”. For a small business buying kit on a company card, that's real money.

Fake charity appeals

December is when many businesses give to charity, and scammers send appeals that copy the tone of real ones, often linked to a recent news story. The money goes to the criminal, not the cause.

Why are holiday cover gaps a risk?

Holiday cover gaps are a risk because many small businesses rely on one or two people knowing what's normal, and those people take leave too. When the usual finance person is off, cover may not know that a supplier never changes banks, or that the boss never asks for gift cards by email.

Criminals know this. Requests that arrive on Christmas Eve, between Christmas and New Year, or late on a Friday tend to say “I know you're short-staffed, but this can't wait”. Pressure plus fewer people checking is exactly the mix they want.

The fix is simple and needs doing before the break: write down who can approve payments while people are away, and agree that no bank details change and no unusual payment goes out until someone has called the person on a number you already hold. Anything genuine can wait until that call happens.

What is the one check for each Christmas scam?

Each seasonal scam has one check that stops it, and most of them mean going to the real site or person yourself rather than through the message.

For charities in England and Wales, use the official register of charities on GOV.UK. Scotland and Northern Ireland keep their own registers, and very small charities may not appear.

Want to see more of these patterns side by side? Our free library of common lures shows eight of them with the red flags marked.

How do I report a Christmas scam in the UK?

In the UK, forward scam texts to 7726 and scam emails to report@phishing.gov.uk; both are free and take seconds. Here's the full list, checked against GOV.UK's reporting guidance and the National Cyber Security Centre:

• Texts: forward the message to 7726. It goes to your mobile provider.
• Emails: forward to report@phishing.gov.uk, run by the NCSC. Also report it inside your business, using your report button or by telling whoever looks after IT, so colleagues can be warned.
• If money has gone: call your bank first, on the number on the back of your card. Then report to Report Fraud online or on 0300 123 2040 (England, Wales and Northern Ireland), or to Police Scotland on 101.

If someone has already tapped the link or entered details, speed matters more than blame. Our clicked-a-link checklist covers the first ten minutes.

Brief your team before December: a 10-minute checklist

A ten-minute briefing in late November does more than any poster. Cover these points at a team meeting, or paste them into your team chat.

1. Track parcels at the source. Never pay a delivery fee from a text or email. Check the order where you placed it.
2. No bank detail changes without a call-back. Call the supplier or employee on a number you already hold. This applies to everyone, every time.
3. The boss will never ask for gift cards by email or text. Say it out loud, and ask the boss to say it too.
4. Find festive documents yourself. Rotas, party details and bonus letters live in your shared drive or HR system. Go there directly.
5. Agree holiday payment rules now. Name who approves payments while people are away, and agree that urgent requests wait for a check.
6. Buy kit from known suppliers. No bank transfers to new shops, however good the deal.
7. Know how to report. Texts to 7726, emails to report@phishing.gov.uk, and always tell someone at work.
8. Make reporting safe. Thank people who flag a scam, and thank them just as much if they tell you they clicked.

If you want the habits to stick past January, practice helps more than one briefing. Lureproof gives small teams a short monthly hands-on assessment and weekly 60-second drills built around patterns like these, including a practice chat with a “supplier” who pushes back when you challenge a bank change. For Google Workspace teams it can also send realistic practice phishing emails, with other providers coming soon; it doesn't send practice texts. You can start with our free security lessons, no sign-up needed.

FAQ