The weeks between Black Friday and the first Monday of January are the busiest of the year for retail inboxes — and for the people who phish them. None of the tradecraft is new. What changes is timing and volume: the excuses attackers lean on suddenly become true. People really are waiting on parcels, chasing refunds and buying gift cards against a deadline. Here are the seven campaign types that reappear every season, how each one looks in a real inbox, and the fastest way to take it apart.

Why the Season Tilts the Field Toward the Attacker

Three things shift in November and December. Legitimate transactional email explodes, so a message about a parcel, an order or a refund stops looking out of place. Deadlines pile up — delivery cut-offs, return windows, the last day to use a discount code — and urgency is the one ingredient phishing cannot do without. And the audience is tired: shoppers are juggling work and family logistics while retail and logistics staff work longer shifts alongside temporary colleagues who have never been briefed on what normal looks like.

Stolen credentials and stolen card numbers do not require sophisticated malware. Most seasonal campaigns are ordinary phishing, aimed at people who have a genuine reason to click.

The Seven Campaigns to Watch

1. Fake delivery and "reschedule your parcel" notices

A courier supposedly tried to deliver while you were out. There is a small redelivery fee, or an address that needs correcting, and a link to a page wearing familiar branding. Most of these arrive by text rather than email, and the fee is deliberately trivial — a few dollars is easy to pay without thinking.

The tell is almost always procedural: genuine couriers do not ask for card details to release a parcel. Open the carrier's own app or type its address into the browser, then enter the tracking number there. If a real charge is owed, it will show up in that account.

2. "There's a problem with your order" and refund phishing

These messages claim a payment failed, an item is out of stock, or a refund is waiting. The next step is a login page or a form asking for your card number, expiry and security code. Remember the direction of money: refunds go back to the original payment method. No retailer needs your card number again to return funds, and no order is fixed by re-entering your password on a page reached from an email.

3. Gift card requests from the boss, the vicar, or a relative

Business email compromise has a predictable shape: an urgent request from someone senior, a reason they cannot take a call, and an instruction to buy gift cards and send photos of the codes. The consumer version is shorter — a new number, a broken phone, a bill that must be paid right now.

Two rules cover almost everything. Verify through a number you already have, never one supplied in the message. And treat any request for payment in gift card codes as fraudulent by default; no employer, charity, tax office or utility collects money that way. Retail cashiers are often trained to flag unusually large gift card purchases. Let them ask the question.

4. Expiring points, rewards and store credit

"You have 4,800 points expiring tonight" is designed to bypass deliberation, and it works because the offer is plausible. The link leads to a credential-harvesting page built to look like the retailer's sign-in screen. Check balances in the app or by typing the retailer's domain yourself. Nothing legitimate expires in the ninety seconds it takes to do that.

5. Lookalike storefronts and poisoned social ads

Deep discounts on scarce items, ads and marketplace listings that appear alongside real retailers, and a checkout page on a domain registered weeks ago. Some of these shops ship a counterfeit; others simply take the card details and vanish. Before buying from somewhere new:

• Check the returns policy and a physical address, not just a contact form.
• Read reviews on forums and review sites outside the seller's own pages.
• Be wary of a site that accepts only bank transfer, crypto or a payment app — those leave you with little recourse.
• Use a virtual or single-use card number if your bank offers one.
• Ask whether the price is plausible. A large discount on this year's most-wanted item usually is not.

6. Retail account takeover and MFA fatigue

Stored payment methods, saved addresses and loyalty balances make shopping accounts worth stealing. Two paths dominate: credential phishing against a password reused across sites, and a flood of login prompts or one-time codes until a tired user approves one. Use a unique password for every shop, let a password manager remember them, and prefer an authenticator app or a hardware key over text messages. Delete stored cards you rarely use. If you receive a login code you did not request, change that password today — someone already has it.

7. Holiday charity and disaster-relief donation pages

Donation fraud tracks the news. Emotional appeals, urgent deadlines and crowdfunding pages with no way to verify who is collecting. Give through the charity's own site, typed by hand, or check it against a national charity register. Paying by card gives you dispute options that bank transfers and crypto do not. Generosity is not the problem; unverified payment routes are.

Where Smaller Organisations Get Hit Hardest

Retailers, clinics, trades and professional offices feel this season through their finance and admin teams. December brings fake supplier invoices, requests to change bank details on an account, purchase-order attachments carrying malware, and gift-card requests aimed at whoever handles the inbox. Staff cover for each other's leave; nobody wants to hold up a payment.

Two policies do most of the work. Any change to payment details must be verified by a callback to a number already on file. And gift card requests are never legitimate, no matter who appears to send them. On the brand side, publishing an abuse address for phishing reports, and getting SPF, DKIM and DMARC right on your sending domains, makes impersonation of your own store considerably harder.

What to Do Before the Next Email Lands

1. Treat urgency as a signal rather than an instruction. A real courier, bank or retailer will still be there in ten minutes.
2. Verify out of band. Open the app, type the domain, or call a number you already have.
3. Never enter card details or a password on a page you reached from a message.
4. Turn on multi-factor authentication and stop reusing passwords across shops.
5. Report as well as delete. Forward phishing to your IT or security contact, the retailer's abuse address, or your national reporting service — it protects the next person.
6. If money has already moved, call your bank's fraud line immediately. For gift cards, contact the issuer with the card number and receipt as fast as possible; speed is the main thing that helps.

For anything involving a significant loss, a business dispute or a payment you were tricked into authorising, take proper advice from your bank's fraud team, your insurer or a qualified professional rather than working it out alone.

Most of this reduces to one habit: check before you act, especially when the clock is being used against you.

Photo: AS Photography / Pexels