Follow JPert in Google — add us as a preferred source.

Laptop on an office desk showing a glowing email security shield, a reminder to check money requests that arrive by email

It is a busy Friday in December. Your office manager gets a short email that seems to come from you: "Are you at your desk? I need a quick favor. Please buy six $200 gift cards for the team and send me the codes. I'm in meetings all afternoon, so just reply by email."

It sounds a little rushed, but it also sounds kind. Your office manager wants to help, so they buy the cards and send the codes. By the time anyone calls you, the money is gone for good.

This is one of the most common scams that small businesses and nonprofits face, and it gets much worse every holiday season. The good news is that it is also one of the easiest to stop once your team knows what to look for.

Why This Scam Works So Well

The scammer does not need to break into your computers. They only need three things: your name, a believable story, and a helpful employee.

The holidays make all three easier. Leaders are traveling, so "I can't talk right now" sounds normal. Staff are already buying gifts and paying year-end bills, so one more purchase does not stand out. Nonprofits are in their busiest giving season, with GivingTuesday on December 1, 2026, which gives scammers an easy cover story.

This is not a small problem. According to the FBI's 2025 Internet Crime Report, Americans filed more than one million cybercrime complaints last year and reported about $20.9 billion in losses. Fake emails that pretend to come from a boss, coworker, or vendor caused more than $3 billion of that on their own.

How the Scam Usually Plays Out

  1. They do their homework. The scammer looks up your leaders and staff on your website or LinkedIn.

  2. They pretend to be the boss. They send an email or text using the boss's name, often from a personal email address or one that is spelled almost like yours.

  3. They start small. The first message is just "Are you available?" to get a reply.

  4. They make the ask. Buy gift cards, scratch off the back, and send photos of the codes.

  5. They add pressure. "It's a surprise, don't tell anyone." "I need this in the next hour."

Once the codes are sent, the money is almost impossible to get back. Gift cards work just like cash, which is exactly why criminals ask for them.

Other Holiday Scams to Watch For

The U.S. Treasury's holiday scam advisory warns about several other tricks that also peak this time of year:

Warning Signs Anyone Can Spot

You do not need to be good with technology to catch these scams. Teach everyone on your team to stop and check when they see:

The most important habit is simple: if a message asks for money, call the person to check. Use a phone number you already have, not one in the message. A two-minute call stops almost every one of these scams.

Five Simple Steps to Protect Your Organization

1. Make a "No Gift Cards by Email" Rule

Tell your team in writing: "Our leaders will never ask you to buy gift cards or change payment details by email or text." Once staff know the rule, a scam request is easy to spot and easy to say no to.

2. Always Call Before Paying

Any request about gift cards, wire transfers, new vendors, or bank changes gets a phone call to confirm. For bigger amounts, have a second person approve it. Our guide to stopping fake business emails goes deeper on this.

3. Add a Second Lock to Your Accounts

Turn on two-step login (sometimes called multi-factor authentication) for email, banking, and payroll. Even if a scammer steals a password, they still cannot get in without the code from your phone.

4. Ask Your IT Team to Flag Outside Emails

Microsoft 365 and Google Workspace can put a clear "External" label on emails that come from outside your organization. That label makes a fake "boss" email much easier to notice. Your IT provider can also set up protections that make it harder for scammers to send emails that look like they came from your own address.

5. Have a Quick Team Talk Before the Holidays

A 15-minute meeting in November that walks through the examples in this article does more than a long annual training. Make it clear that anyone who clicks something by mistake should speak up right away, with no blame. Fast reporting limits the damage. Our phishing awareness guide has more ideas.

If Someone Already Sent Money

Act fast. Call your bank and the gift card company right away, since they can sometimes freeze the funds. Then report it to the FBI at IC3.gov and the FTC at ReportFraud.ftc.gov. If an email account was involved, change its password and ask your IT provider to check it for other problems.

A Note for Nonprofits

Before GivingTuesday, check who can edit your online donation forms, and remind volunteers that your organization will never ask them to buy gift cards. For more, see our guide to protecting donor information.

Final Thoughts

Holiday scams work because they feel ordinary. A note from the boss or a message about a package does not look like a cyberattack. A few clear rules and a culture of "call to check" stop most of them, and they cost far less than one lost stack of gift cards.

Good security is not just an expense. It protects the trust your clients, donors, and staff place in you. JPert helps Northern Virginia businesses and nonprofits put these protections in place through our cybersecurity services and security awareness training. Book a free IT assessment and we will review your email and payment safeguards before the holidays.

Sources

JPert supports organizations across Tysons, Vienna, McLean, Reston, Herndon, Fairfax, Falls Church, Ashburn, Sterling, and Leesburg.

Want more JPert cybersecurity and IT tips in your Google results? Add JPert as a preferred source.