The Inbox Before the Invoice: Six Holiday Scam Patterns and a Two-Minute Check
Photo: Familydestinationsguide.com Images, CC BY 2.0, via Wikimedia Commons
The holiday shopping season does not begin at the cash register. It begins in the inbox, the text thread, and the social feed, where criminal campaigns compete for attention before consumers have decided what to buy. Threat intelligence teams see the same rhythm each year: infrastructure is prepared weeks in advance, lures are tested against small audiences, and successful templates are scaled as shipping volume and charitable giving rise.
For 2026, the stretch between Veterans Day on November 11 and Cyber Monday on November 30 deserves particular attention. Households are juggling deliveries, travel plans, family requests, and end-of-year donations. The six patterns below are not speculative; they are durable criminal business models dressed in seasonal clothing.
1. Fake delivery notices that arrive before the package
A text message claims a parcel is held at a depot, a delivery failed, or a small fee is due. The link leads to a page that looks like a major carrier but asks for card details or account credentials. The timing is the trick: during peak shipping weeks, a vague notice feels plausible because multiple packages may actually be in transit. The defense is simple. Do not use the link. Open the carrier's official website or app directly, enter the tracking number from a purchase confirmation, and check the status there. Legitimate carriers do not demand payment through a shortened link.
2. QR codes that move the phishing page to your phone
QR-code phishing, often called quishing, has moved from parking meters and restaurant menus into email and direct mail. A message may include a QR code to reschedule delivery or claim a holiday reward. Scanning it opens a mobile browser where URL bars are compressed and security warnings are easier to miss. Before scanning any code from an unsolicited message, ask whether the sender could have provided a normal link. If the code is unavoidable, use a scanner that previews the URL, and never enter credentials or payment data on a page reached that way.
3. Marketplace escrow tricks that borrow trust from the platform
Facebook Marketplace, OfferUp, and similar services are fertile ground for a scam in which the buyer or seller proposes an off-platform escrow service. The site looks official, the emails look transactional, and the victim is told that funds are held until shipment is confirmed. In reality, the escrow site is controlled by the fraudster. The rule is to keep payment and communication inside the platform's own system. A legitimate buyer will not ask a seller to pay a refundable deposit, and a legitimate escrow service will not appear through a link in a chat thread.
4. Gift-card requests dressed as urgency
Gift cards remain attractive to criminals because they are easy to transfer and hard to reverse. A familiar pattern involves a message that appears to come from a boss, a pastor, a family member, or a contractor asking for gift cards to be purchased quickly for a client or an emergency. The request usually includes a reason to stay quiet and a deadline. Verify through a separate channel: call the person at a number you already have, not the number in the message. For businesses, require dual approval for any gift-card purchase and train accounts payable to treat urgency as a red flag.
5. AI-generated deal ads and storefronts
Generative AI has made it cheaper to produce polished product photos, fake reviews, and video ads featuring familiar faces. A shopper may see a sponsored post for a premium brand at an implausible discount, click through to a professional-looking storefront, and complete checkout on a site that never ships. Check the domain age, look for a verifiable business address, and search for independent reviews outside the site. If a deal requires payment by wire, cryptocurrency, or gift card, close the page.
6. Charity fraud with a seasonal hook
Holiday giving is emotional, and criminals exploit that. Fake charities may use names that resemble well-known organizations, create urgent appeals around veterans, children, or disaster relief, and pressure donors to give immediately. Use the IRS Tax Exempt Organization Search or a charity rating service to confirm the organization. Pay by credit card so that a dispute is possible, and never let a caller guide you to a payment page.
The two-minute verification routine
When a holiday message asks for money, credentials, or a click, run a short routine. First, pause and identify the channel: email, text, social message, or phone call. Second, verify through an independent path: a known phone number, a typed website address, or an app you already have. Third, inspect the request for pressure, secrecy, or unusual payment methods. Fourth, check the link or domain without clicking; on mobile, preview the URL. Fifth, confirm with a household rule: no gift cards, no remote access, and no password sharing based on an unsolicited message. The routine takes about two minutes and scales from a single shopper to an accounts payable team.
A layered defense for the season
No single habit eliminates fraud. At NortonShield Pro, we recommend pairing verification routines with reputable security software on phones and computers, cautious link handling, and a family agreement that money requests are confirmed by voice. Tools such as Norton Genie can help assess suspicious messages, while Norton 360 with LifeLock adds device protection and identity monitoring for households that want a broader safety net. The goal is not paranoia. It is a reliable pause between a convincing message and an irreversible action.
