The message lands at 6:40 on a Tuesday evening in mid-December: your parcel could not be delivered, confirm your address within twelve hours or it goes back to the sender. There is a tracking number, a courier logo and a button. The person reading it is waiting on three orders and has already had a long day.
That is all a phishing email needs. The same message in July gets deleted. In December it gets clicked, because for a few weeks the story fits what is genuinely happening in your life and in your company's inbox.
Nothing about the underlying fraud changes in winter. The context does. Order volumes climb, so a delivery notification is expected rather than suspicious. Finance teams close the year, which means invoices from suppliers you half-recognise are arriving anyway. People take leave, so approvals compress and the person who normally checks the bank details is away.
Add the human details. Staff skim email on phones between meetings. New starters don't yet know which suppliers are real. Out-of-office replies confirm exactly who is unavailable and when. Attackers don't need sophistication when the calendar does so much of the work for them.
A familiar courier logo, a plausible tracking number, and a small fee — a few pounds, a redelivery charge, a customs payment — requested by card. The amount is deliberately trivial, because nobody argues about small sums. Sometimes the link simply opens a page that harvests an email password, which is far more valuable than the fee.
Treat it as suspicious when a delivery message arrives from a domain that isn't the courier's own, when the tracking number leads to a page with no real shipment history, or when payment is requested through a link. If you are actually expecting something, open the courier's website yourself and type the reference in there.
The pattern barely changes: a message from a senior person, apologising for the short notice, asking for gift cards for client thank-yous. They're in meetings, they can't talk, please send the codes. Once the codes are read out, the money is gone and cannot be recovered.
The tell is not the writing style. It's the request itself. Legitimate organisations do not buy gift cards as a payment method, and no genuine executive needs you to bypass the usual purchasing process. Verify by calling the person on a number you already have, not one supplied in the message.
These are quieter and cause more damage. A PDF arrives that looks like a real supplier's invoice, with only the bank details changed. Or a past-due reminder for software your company does use, at an amount small enough that someone pays it to close the ticket.
Watch for the thread hijack too: a genuine email chain, same subject line, and a short reply saying the account details have been updated. The sender may be a compromised mailbox belonging to someone you actually work with.
No single flag proves anything. Two or three together mean you stop, and you check.
This is the habit that prevents most losses. Use contact details you already hold — the number on the supplier's website, the contact in your finance system, the extension in your directory. Never use the phone number, link or email address supplied in the suspicious message itself.
Ask a question an impostor can't answer: the last invoice number, the name of your account manager, the delivery address on file. Then log a decision somewhere visible so a colleague doesn't approve the same payment tomorrow.
We don't change bank details because an email says so. We change them because a person we called confirmed it.
Put that sentence in your finance process, in writing, this week. Pair it with a second rule: any change of payment details needs two people to confirm it independently. If money has already left, contact your bank immediately and ask them to attempt a recall — outcomes depend heavily on speed. For large sums, speak to your bank's fraud team and take professional financial advice before assuming the loss is final.
Someone who reports a click in five minutes is far more useful than someone who spends an afternoon hoping nobody notices. Say that out loud, more than once.
You don't need a training programme. Put five minutes on the agenda at your next team meeting and show two real examples with the identifying details masked. Walk through the three email types above, then agree on the single non-negotiable rule about verifying payment changes by phone.
Remind everyone that the same scams follow them home — the parcel texts and the gift card messages don't stay at work. Ask anyone who approves spending to apply the same scepticism to reminders and small invoices as they would to a large one.
Then let people take their holiday. A team that knows what to look for, and knows that reporting quickly is a good thing rather than a confession, will handle December far better than one relying on luck and a spam filter.
Unassigned seats, duplicate subscriptions and forgotten renewal dates drain small IT budgets quietly. Here are ten...
Free antivirus covers basic malware blocking, but paid tiers add phishing defence, VPNs, parental controls, priority...
SSDs cut boot times and survive drops; hard drives still win on cost per terabyte. Here is how to match each drive...
Your trusted source for reliable IT solutions.
