Every item on that list is ordinary. Every item is also a ready-made script for a scammer. The "CEO" needs gift cards for client thank-yous. The "vendor" has new banking details just in time for the year-end payment. The "carrier" says a package is stuck and needs a $1.99 redelivery fee.
None of these require hacking anything. They require one busy person, on one hurried afternoon, to say yes. The good news: the habits that stop them can be taught in less time than a staff meeting.
How do you train employees to spot holiday scams? Run short, scenario-based sessions on the three scams that surge this season: gift card requests from fake executives, invoice and payment-change fraud, and fake delivery texts. Teach one simple rule for each, back those rules with written policy, and make reporting a suspicious message fast and blame-free.
Because attackers follow the money, and in November and December the money moves faster. Purchasing goes up, approval chains get thinner as people take time off, and everyone expects packages, invoices, and last-minute requests.
The numbers show what's at stake for businesses all year long, before the seasonal surge even starts:
Business email compromise (BEC), where criminals impersonate an executive or vendor to redirect a payment, cost victims nearly $3.05 billion in 2025 across 24,768 complaints to the FBI.1
Phishing and spoofing were the most reported cybercrime of 2025, with 191,561 complaints.1
People reported losing nearly $1 billion to scammers impersonating businesses in 2025, part of a record of roughly $16 billion in total reported fraud losses.2
Fake package delivery problems topped the FTC's most recent ranking of text message scams, and text scams overall cost people $470 million.3
Those losses aren't proof that people are careless. They're proof that these scams are designed by professionals to work on smart, busy people. That's exactly why a little rehearsal goes such a long way.
Here's a quick reference managers can share with their teams.
| Scam | How it usually arrives | Red flags | The one rule to teach |
| Gift card ("fake boss") | A text or email using an executive's name: "Are you free? I need a quick favor." | Urgency, secrecy, a request to send card numbers and PINs, odd terms like "certificates" | We never pay anyone with gift cards. Verify any favor by calling the person on a number you already have. |
| Invoice and payment change | An email from a familiar vendor, or a lookalike address, with new banking details or an "overdue" invoice | Changed account numbers, pressure to pay before year-end, a slightly altered sender address, a request to skip approval | No payment details change without a call-back to a verified contact. |
| Delivery and shipping | A text or email saying a package can't be delivered, with a link to pay a fee or "confirm your address" | A message you weren't expecting, a small fee, a lookalike link, a request for card or login details | Track packages at the source. Open the carrier's app or type its website yourself; never use the link. |
The gift card scam deserves extra attention this time of year because it blends in so well with real holiday tasks. In a January 2026 alert, the FTC described scammers posing as bosses who ask for an urgent favor tied to a company event, sometimes calling the cards "certificates" to avoid suspicion. Its advice was direct: only scammers will ask for gift card numbers and PINs.4
You don't need a new platform or a half-day workshop. You need four short huddles, one a week from mid-November through mid-December, each built the same way:
3 minutes: Show a realistic example. A real one from your own inbox, with names removed, works best.
5 minutes: Ask the team to call out the red flags.
5 minutes: Walk through what to do instead, step by step.
2 minutes: Repeat the one rule and where to report.
Show a text "from" your CEO asking someone to pick up gift cards for client thank-yous and send the codes. Ask the room what they would do if it were real. Then practice the verification step: set the phone down, look up the leader's number in your company directory, and call. Close with the rule, and say out loud that no leader will ever be upset that someone checked.
This one is built for anyone who touches accounts payable, purchasing, or vendor relationships, plus the executive assistants who are frequent impersonation targets. Show a vendor email announcing new bank details and have the team compare the sender address character by character. Then walk through your call-back process using the phone number already on file, never the one in the email. If you don't have a written payment-change procedure, this session will make that obvious quickly.
Everyone gets these, at work and at home, which makes this the easiest session to run. Show a fake carrier text with a small redelivery fee and point out the link domain. Practice the habit: open the carrier's app or type its website yourself. Remind the team that a $2 "fee" paid on a fake site can hand over a card number, and sometimes a login, in the same step.
This is the session that matters most. Show exactly how to report a suspicious message (a report button in Outlook, a dedicated email address, or a quick Teams message to IT) and explain what happens next. Make it clear that someone who clicks and reports within two minutes did the right thing. Fast reporting is what turns one mistake into a non-event. Our guide to running phishing drills that actually train your team covers how to measure it.
Training builds the reflex. Policy and technology make the right choice the easy one. Before the holidays, confirm these are in place:
A written no-gift-card rule. Legitimate gift card purchases go through normal purchasing, and approval can never be requested by text.
A payment-change procedure. Any change to vendor banking details requires a call-back to a verified contact and a second approver.
Named backup approvers for PTO weeks. No one should feel pressure to bend the rules because the usual approver is on vacation.
A one-click way to report. A report button or a single, well-known address that everyone can find without thinking.
Technical backstops. External sender tags, email authentication on your domain (SPF, DKIM, and DMARC, the settings that make your domain harder to spoof), and multi-factor authentication on email and banking.
If any of those feel shaky, our breakdown of email security for small businesses explains the threats each control addresses.
At Sentry, we see the same pattern every year: businesses that have invested in solid security tools still get caught by one convincing request at the worst possible moment. That's why people are a core control in the Secure stage of our Technology Maturity Model (TMM), the four-stage roadmap (Operate, Secure, Integrate, Innovate) we use to guide growing businesses.
A business operating at the Secure stage doesn't depend on people being perfect. It combines trained people, clear policies, and technical safeguards so that one hurried click doesn't become a lost payment. Seasonal huddles are a practical way to strengthen that stage, and they work best as part of the year-round program we outlined in security awareness training in 2026.
The approach scales, too. A single office, a franchise system with dozens of locations, or a portfolio of acquired companies can all run the same four sessions, with the same rules and the same reporting path everywhere.
Picture the week before Christmas with these habits in place. A text arrives asking for gift cards, and your office manager calls the CEO to check, then forwards the message to IT. A "new banking details" email hits the call-back process and goes no further. Someone gets a delivery text, opens the carrier app instead, and posts a heads-up in the team channel.
Nothing dramatic happens. That's the point. Your team closes out the year focused on clients and results, not on chasing a wire transfer.
About 15 minutes per session is enough when each one focuses on a single scam and a single rule. Four short sessions spread over a month build stronger habits than one long training, because people practice the behavior more than once.
Everyone. Gift card and delivery scams target employees at every level. Add the invoice session for anyone in finance, purchasing, or operations, along with executive assistants and front-desk staff.
Report it to their manager and IT right away. For a payment, contact your bank immediately to request a recall; for gift cards, contact the card issuer and keep the receipt. You can also report the incident to the FBI at ic3.gov and to the FTC at reportfraud.ftc.gov.
Yes. Seasonal sessions are a helpful boost, but the strongest results come from year-round training with realistic simulations and measured reporting. If you don't have a program yet, holiday huddles are an easy place to start.
Track how many suspicious messages employees report and how quickly they report them. Rising report counts and faster reporting times are better signs of a healthy security culture than click rates alone.
You don't have to build a training program from scratch. We help growing businesses put training, policies, and safeguards in place that fit their stage on the Technology Maturity Model, so your team can spot the scam and keep moving.
Want a training plan in place before the holidays? Book a Project Consultation. [PLACEHOLDER LINK]
1. Federal Bureau of Investigation, Internet Crime Complaint Center. "2025 IC3 Annual Report." April 2026. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
2. Federal Trade Commission. "FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025." June 15, 2026. https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025
3. Federal Trade Commission. "Top Text Scams of 2024" (Data Spotlight). April 14, 2025. https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2025/04/top-text-scams-2024 [Verify before publishing: check whether the FTC has released a 2025 text scam ranking and update if so.]
4. Federal Trade Commission, Consumer Alert. "No, That's Not Your Boss Asking You to Buy Gift Cards." January 2026. https://consumer.ftc.gov/consumer-alerts/2026/01/no-thats-not-your-boss-asking-you-buy-gift-cards