The holiday rush is when small businesses are busiest, most distracted and handling the most payments. Scammers know that. Fake invoices, urgent “payment change” emails and gift card schemes tend to spike when owners and staff are moving fast.
The good news is that most scams rely on the same few tricks, and a simple set of habits can stop the majority of them. Here’s a practical checklist you can share with your team this week.
1. Treat every “new bank details” request as suspicious
One of the most costly scams is the payment redirect. A message arrives that looks like it’s from a supplier, landlord or contractor, saying their bank account has changed and asking you to pay the next invoice to new details.
Your rule: never change payment details based on an email or text alone. Call the vendor using a phone number you already have on file, not one in the message, and confirm the change with someone you know.
2. Check invoices against real orders
Fake invoices often look professional and use real-sounding company names. Before paying, ask:
- Did we actually order this?
- Does the amount match the quote or purchase order?
- Is this a vendor we’ve paid before?
If you can’t match an invoice to a real order, don’t pay it until you’ve confirmed it.
3. Slow down on urgent requests
Scammers manufacture urgency: “Pay today or your account will be suspended,” or a message that appears to come from the owner saying, “I need you to buy gift cards for a client right now, keep it quiet.” Urgency plus secrecy is a classic red flag.
Make it a team rule that no one will ever be punished for pausing to double-check a request, even one that seems to come from the boss.
4. Never pay with gift cards
Legitimate businesses and government agencies don’t ask to be paid in gift cards. Train staff that any request to buy gift cards and send the codes, whether by email, text or phone, should be treated as a scam until proven otherwise.
If you sell gift cards, watch for customers buying unusually large amounts, especially if they seem to be following instructions on a phone call. They may be a scam victim.
5. Teach the phishing basics
Phishing emails try to get someone to click a link or share login details. A few quick checks help:
- Look closely at the sender’s address, not just the display name.
- Hover over links before clicking to see where they really go.
- Be wary of unexpected attachments, especially “invoices” or “shipping notices.”
- When in doubt, go to the website directly instead of clicking the link.
6. Turn on two-factor authentication
For email, banking, payment processors and your point-of-sale system, turn on two-factor authentication where it’s offered. Even if a password is stolen, a second step makes it much harder for someone to get in.
7. Limit who can send money
Decide who on your team can approve payments and who can change vendor details. For larger payments, require a second person to sign off. This simple separation catches many mistakes and scams before money leaves the account.
8. Know what to do if something goes wrong
Write down a short plan now:
- Call your bank immediately if you think you’ve sent money to a scammer. Speed matters.
- Change passwords on any account that may be affected.
- Report the incident. In the U.S., the FTC accepts fraud reports at ReportFraud.ftc.gov, and the FBI’s Internet Crime Complaint Center handles online fraud.
- Tell your staff what happened so they can spot similar attempts.
Make it a five-minute team huddle
You don’t need a long training session. Print this checklist, go over it at a quick pre-shift huddle and post it near the register or office computer. Repeating the basics during the busiest weeks is what makes them stick.
The bottom line
Holiday scams work because people are busy and rushed. Slow down on payment changes, match every invoice to a real order, never pay with gift cards and make double-checking a normal part of the job. A few minutes of caution can protect your season’s hard-earned revenue.
Image: Cybersecurity by jaydeep_ via Wikimedia Commons, CC0 1.0
