How to spot a phishing email before the holiday rush

Every year from October through the new year, inboxes fill up with shipping notices, order confirmations, gift card offers, invoices, and year-end requests. Attackers know it. Phishing emails blend in with all that legitimate traffic, and a busy employee clearing a full inbox is exactly who they are counting on.

The good news is that most phishing emails give themselves away if you know where to look. Here is what to check before you click, and what to do if you already did.

Seven signs of a phishing email

1. The sender doesn’t quite match. The display name says “Microsoft Support” or your bank, but the actual address is something like support@micr0soft-billing.com. Look at the address, not just the name. On a phone, tap the sender’s name to reveal it.
2. It creates urgency or fear. “Your account will be closed in 24 hours.” “Unusual sign-in detected.” “Your package could not be delivered.” Pressure is meant to make you act before you think.
3. The link goes somewhere else. On a computer, hover over a link without clicking and the real destination appears in the corner of the window. On a phone, press and hold. If the domain isn’t the company’s real one, don’t click.
4. It asks for something sensitive. Legitimate companies don’t ask you to confirm a password, a verification code, or a full card number by email.
5. The request is unexpected. A delivery notice when you ordered nothing, an invoice from a vendor you don’t use, a shared document from someone you barely know.
6. An attachment you didn’t ask for. Be especially careful with files that ask you to “enable content” or “enable macros,” and with unexpected PDFs or HTML files that lead to a sign-in page.
7. Something is slightly off. Odd greetings, awkward phrasing, a logo that looks blurry, or a message that is oddly generic. That said, don’t rely on typos alone. AI tools have made polished, error-free phishing emails easy to produce, so a clean-looking message isn’t proof of a safe one.

Scams that spike during the holidays

• Fake shipping and delivery notices with a link to “reschedule” or “pay a small fee.”
• Order confirmations for things you never bought, with a phone number to call or a link to “cancel.” The phone number reaches the scammer.
• Gift card requests that appear to come from your boss: “I’m in a meeting, can you pick up some gift cards for clients? I’ll reimburse you.” This is a classic impersonation scam.
• Fake invoices and payment changes. A vendor “has a new bank account” just as year-end bills come due. Always confirm payment changes with a phone call to a number you already have.
• Year-end documents such as a “shared HR file,” “updated W-2,” or “bonus schedule” that sends you to a fake Microsoft 365 sign-in page.
• Charity appeals from organizations you have never heard of.

What to do instead of clicking

Go to the source yourself. Type the company’s address into your browser, open its app, or call the number on its website or your last statement. Never use a phone number or link from the suspicious message.

If an email claims to be from your boss, a coworker, or a vendor and asks for money, gift cards, or a change to payment details, confirm it using a different channel: a phone call, a text message to a number you already have, or in person.

If you clicked or entered a password

It happens to careful people. What matters is how fast you act:

1. Don’t keep going. Close the page. Don’t enter anything else.
2. Change the password right away from a different, trusted device, and change it anywhere else you used the same one.
3. Tell your IT person or manager immediately, even if you feel embarrassed. A quick report limits the damage, and everyone else can be warned.
4. Watch for follow-up problems: sign-in alerts, mail rules you didn’t create, or messages sent from your account that you didn’t write.
5. If you shared card or bank details, contact the card issuer or bank right away.

Your IT provider can also sign out all active sessions, reset the account’s credentials, and check for forwarding rules that attackers set up to keep reading your mail.

Make phishing less costly for the whole business

Spotting emails is one layer, not the whole defense. A few other steps make a mistake much less costly:

• Turn on multifactor authentication for every account, so a stolen password alone isn’t enough. See MFA for small businesses: security defaults or Conditional Access?
• Make reporting easy and blame-free. People report mistakes quickly only when they won’t be punished for them. Microsoft 365 includes a Report button in Outlook for suspicious messages.
• Set a rule for money requests. Any new payee, changed bank detail, or gift card request gets confirmed by phone before anything is paid.
• Brief your team now. A ten-minute reminder in early November, before the busiest weeks, is worth more than a long training session in the spring.
• Keep email filtering and updates current, so the most obvious attacks never reach an inbox.

The bottom line

When a message makes you feel rushed, worried, or unusually pleased, pause. That feeling is the signal. Verify through a channel you trust, and report anything that looks off.

Want help tightening up your email security or putting together a short briefing for your team before the holidays? Email me and we’ll work out a plan that fits your business.