The festive season is a busy time for most businesses. Deadlines to meet, end-of-year finances to close, people taking annual leave and inboxes filling up with seasonal emails.
Cyber criminals know this and they take full advantage.
Every year, phishing attacks increase significantly in December. Attackers rely on distraction, urgency and familiarity, all of which are far more common at this time of year.
Why phishing increases at Christmas
Phishing works best when people are rushed or distracted. During the festive period:
Teams are often short-staffed due to holidays
Senior decision-makers may be less available
Normal approval processes are more relaxed
People expect more emails about deliveries, payments and offers
This creates the perfect environment for attackers to slip through unnoticed.
Common festive phishing scams to watch for
Fake delivery notifications
Emails or texts claiming a parcel is delayed or needs action. These often include malicious links or attachments designed to steal login details.
End-of-year invoices and payment requests
Attackers impersonate suppliers and request urgent payment before the Christmas break.
HR and payroll scams
Messages pretending to come from HR about bonuses, pay changes or updated personal details.
Gift card fraud
Emails that appear to come from senior staff asking for gift cards to be purchased urgently, often framed as Christmas gifts or thank-you gestures.
Why these attacks are so effective
Festive phishing emails are successful because they:
Create urgency and pressure to act quickly
Appear relevant and expected
Use familiar names, branding and language
Exploit goodwill and seasonal behaviour
Once an attacker gains access to an account or receives a payment, the impact can be immediate and costly.
Simple steps everyone can take this Christmas
Awareness and good habits go a long way.
Pause before you click
Take a moment to question unexpected emails, especially those asking you to act quickly.Check the sender carefully
Look closely at email addresses, not just the display name.Be cautious with urgency
Urgent requests, secrecy or pressure are classic warning signs.Avoid clicking links in delivery emails
If you are unsure, go directly to the supplier’s website instead.Report anything suspicious
Notify your IT or security team as soon as something does not feel right.
How Roadmap can help
Roadmap helps businesses reduce phishing risk through:
User awareness training
Phishing simulations and testing
Email security and monitoring
Incident response planning
If you would like advice or support, our team is here to help.