Holiday Scam Plan for Small Offices

The weeks before Thanksgiving get busy. People cover for each other, and a seasonal hire may be answering the phone. A text from the owner, new bank details, or a delivery notice can look like ordinary work.

Four rules cover many of those money requests. Print the card on this page, fill in the blanks, and hand it to every desk. It's for an owner or office manager at a business of about 5 to 50 people, and for the front desk, bookkeeper, and seasonal staff.

The short answer

What should a small office do about holiday payment requests?

Nobody buys gift cards, or sends card numbers, because of an email, a text, or a chat message. That includes a message that uses the owner's name.
Every request to pay, to change bank details, or to send information gets a phone call first, to a number the office already has on file.
Name one backup approver before the owner leaves. If that person can't be reached, the payment waits.
We never type a code, approve a sign-in, or install software because a message asked. Open your usual bookmark or ask IT.

The "boss needs gift cards" text

The usual message is short and urgent. It may say the sender is in a meeting, or ask you not to call. It uses a name people already trust.

BBB's holiday list for businesses says scammers "impersonate 'the boss' and ask employees to buy gift cards for holiday bonuses or a party, or to rush a wire transfer before the office closes for the year." BBB says to "confirm payment requests by calling the sender at a number you already have."

Don't buy the cards. Don't send a number, a PIN, or a photo of the card. Call the owner at the number already on file. If there's no answer, the request waits. NIST's small-business phishing page says the same for an urgent message from a boss or a vendor: "contact them directly to verify the message."

Five holiday requests worth a pause

Pause on these. They are patterns, not a claim that each one is a new campaign this week.

Boss gift-card text. Call the owner at a known number.
"Updated bank details" from a vendor. Call a contact you already have, and get a second approval. BBB says to require one "for wire transfers and for any change to a vendor's bank details."
Delivery notice with a link or a fee. Open the carrier's site or app yourself.
Bonus, payroll, or benefits notice asking for a sign-in or a code. Open payroll from your usual bookmark. Don't enter a code for a sign-in you didn't start.
"IT needs you to install something," or a call about a computer. Confirm it with your usual IT contact first.

A missing laptop on a trip has its own list: lost or stolen work laptop.

Who approves payments while the owner is away?

Name one backup before the owner leaves. Write the name and phone number on the card. Pick a dollar amount above which a second person also has to say yes.

If the approver can't be reached, the payment waits.

Tell the bookkeeper who the backup is and where the vendor numbers on file are kept. Tell the bank, at the bank's own number, who may approve payments. Leave a phone number the backup can reach.

A 10-minute briefing for seasonal staff

Hand over the card. Read the gift-card rule and the "call a number we already have" rule. Show who to tell if something looks off, with that name and number filled in. Say that asking is fine. Seasonal hires may not know the owner's number. The card has it.

Printable staff card

Print this section. Put a copy by the desks that pay bills or answer the phone.

Our Holiday Money Rules (post by every desk)

We never buy gift cards or send card numbers because of a message. Not from email, text, or chat, even if it looks like it's from the owner.
Every request to pay, change bank details, or send information gets a phone call first, to a number we already have on file, not one in the message.
If the person can't be reached, the request waits. Nothing is urgent enough to skip the call.
We never type a code, approve a sign-in, or install software because a message asked. Open your usual bookmark or ask IT.

Our payment approver while ______ is away: __________ at __________ (phone: __________)

Second approval needed for payments over $__________.

If something looks off, tell: __________ at __________ (phone: __________)

Saying "I'm not sure" is always fine.

If someone already sent money or gift-card codes

Call the same day and tell the owner. A refund is not guaranteed. Asking for help is fine.

Gift cards. Call the number on the card. Say someone else has the number and PIN, and ask what the issuer can do. Keep the card and the receipt. You can file a report at ReportFraud.ftc.gov.

A bank payment. Call the bank at a number you already have. NIST says that if a phishing attack compromised the company's account at a financial institution, "contact the bank immediately to report the incident." Then tell your IT provider.

Passwords. NIST says, if possible, "immediately change the password for any affected accounts." Change the password on any other account that used the same one. If a bank alert is open or mail won't open, use the first 60 minutes after a cyber incident, including signing other sessions out from a clean device.

If you have cyber insurance, check that policy's reporting steps. This page doesn't say what the policy requires.

Three checks to ask your IT provider this month

Send these as questions. You don't have to change the settings yourself.

Is multifactor authentication on for email, and for the bank login? NIST asks whether MFA is "required and used on all accounts that offer it," especially accounts that access sensitive information. The MFA coverage drill checks Microsoft 365 in about 20 minutes.
How do emergency admin accounts sign in, and where are the keys? Microsoft's emergency access page says to use Passkey (FIDO2) (Recommended) or certificate-based authentication. Those methods "satisfy the mandatory multifactor authentication requirements." Microsoft says to "Store credentials in secure, fireproof safes that are in secure, separate locations." Don't keep the key on one employee's phone. Keep the accounts out of Conditional Access policies that block or restrict sign-in. If a policy requires MFA, a compliant device, or another control, "the account might be unusable during the exact emergency scenarios it's designed for." The admin hygiene checklist covers who holds admin.
Security Defaults, or Conditional Access? Use one. Microsoft's Security Defaults page says: "Organizations that choose to implement Conditional Access policies that replace security defaults must disable security defaults." After Security Defaults are off, organizations "should immediately enable Conditional Access policies to protect their organization." That page lists Conditional Access as needing at least Microsoft Entra ID P1, and Security Defaults as needing no license. The overview is Conditional Access. Ask for the answer in writing with the questions for your IT host.

FAQ

What should employees do if the boss texts asking them to buy gift cards?

Don't buy the cards, and don't send any numbers. Call the owner at the phone number already on file, not the number in the text. If the owner can't be reached, the request waits.

Who should approve payments when the owner is away over the holidays?

Name one backup approver before the owner leaves. Write the name and phone number on the staff card, and set a dollar amount above which a second person must approve. Tell the bank who the backup is, using the bank's number already on file. If the approver can't be reached, the payment waits.

What should we do if someone already sent gift-card codes?

Call the number on the card, say someone else has the number and PIN, and ask what the issuer can do. Keep the card and the receipt. You can file a report at ReportFraud.ftc.gov. Change the password on any account that was involved. A refund is not guaranteed.

Related guides

Educational content only — not legal, insurance, or compliance advice.