Experts Call for Vigilance as Holiday Scams Increase

Nothing says the holidays like ripping off your loved ones. And as shopping surges and inboxes bulge, criminals are pouncing with impersonation, phishing and payment scams that can turn a good deal into your worst nightmare. Losses are increasing, and the tactics are sharpening, consumer watchdogs say.

The Federal Trade Commission says that consumers lost more than $10 billion to fraud in 2017, the highest figure on record, while the F.B.I.’s Internet Crime Complaint Center counted about $12 billion in losses. Travel, delivery and goodwill scams surge during the festive rush when urgency and distraction are a scammer’s best allies.

How Holiday Scammers Get to You and Your Money

• Delivery posers: Texts or emails that say there is an issue with a package and they need a modest “redelivery fee,” often spoofing postal or courier brands. The link sends readers to either a credential-stealing page or a fake checkout page.
• Order confirmations you didn’t place: “Receipt” messages from known companies prompt you to click a “view order” button to dispute the charge. It’s a trap to collect logins or card information.
• Marketplace scams: “Overpayment” scams on local buy-and-sell apps, buyers asking to move to private chats or trying to wrangle odd payment methods such as gift cards or crypto.
• Charity lookalikes: Scam nonprofits use similar-sounding names to siphon donations away from established organizations. A tell is pressure to “donate now.”
• How to spot travel and rental steals: Vacation deals that are too good to be true, “owner direct” rentals with payment methods like wire transfers, or cloned listings for thousands off market rates.
• QR code bait: Stickers layered on top of real codes on parking meters, restaurant tables or fliers that lead victims to payment pages run by criminals.

Red Flags That Reveal a Scam Before You Click or Pay

• Sense of urgency or threat: “Act in 10 minutes,” “account will close” and “final notice” language is designed to short-circuit your judgment.
• Strange payment demands: Favorite requests include gift cards, wire transfers, crypto ATMs or P2P payments to strangers — because those are all tougher and time-consuming to undo. But as the F.T.C. observes, gift cards continue to be a leading demand from fraud reports.
• Lookalike senders: Domains (e.g., paypaI.com vs. paypal.com), superfluous words or odd country codes. On phones, you can long-press links to see the full URL before tapping.
• Verification-account traps: If a message unsolicitedly asks you to “verify,” “reset” or some other kind of confirmation, it’s almost certainly phishing. Instead, just go directly to the app or site.

Pay Smart to Minimize Damage from Holiday Fraud

• Use credit, not debit: Credit cards come with fraud protections and keep your bank balance insulated. Create one-time virtual card numbers where possible.
• Tap-to-pay and wallets: Tokenized payments, through Apple Pay, Google Pay or contactless cards, minimize exposure because merchants don’t get access to your real card number.
• Skip direct transfers to strangers: Gift cards, wire services and irreversible P2P payments for purchases that don’t arrive are generally off-limits. If a seller refuses, leave it.
• Enable notifications for spending: Notifications in real time from your bank or card issuer can help you catch and stop fraud quickly.

Guard Your Accounts and Devices with Simple Steps

• Switch on multifactor authentication: Choose an authenticator app or passkeys for email, shopping and social accounts. Avoid SMS codes when possible.
• Update and put on auto-patch: Keep your phone, your browser and software (like security software) up to date so that all known holes are closed before they can be attempted by attackers.
• Try a password manager: Unique, long passphrases thwart credential stuffing. If one site gets breached, the damage does not propagate.
• Secure your network: Stay off public Wi‑Fi when you log on to bank accounts. Think about relying on your mobile hotspot when you’re checking out from the road.

If You Get Hooked, Move Fast to Limit the Fallout

• Kill the payment: Call your bank or card issuer to dispute charges and get a new card. For P2P apps, process a claim immediately.
• Lock down accounts: Switch to new passwords for any account that shared the same password information. Delete active sessions and log them out.
• Scan and monitor: Perform a trustworthy security scan on those devices. Think about freezing credit or placing fraud alerts with major bureaus if identity data was exposed.
• Report it: File complaints with the FTC and the F.B.I.’s IC3. Report to Scamwatch and your bank in Australia. Save screenshots, receipts and message headers.

Real Cases to Learn From During the Holiday Season

• Fake parcel texts: Customers were sent “delivery failed” SMS messages including a truncated URL to a convincingly fake courier portal. Typing in the card numbers led to small test charges, followed by large purchases overnight.
• Marketplace overpayments: A reader received a piece of evidence — and possibly some consolation — about what one should do if they receive an “accidental” overpayment from a buyer on a site such as eBay or Craigslist, along with advice to refund the difference in gift cards. The initial payment never went through, and the seller was out the full sum.
• QR code swap: Stickers were pasted over parking meter codes by fraudsters. Drivers scanned and paid on a spoof site, providing card numbers and CVV to thieves.

The Bottom Line: Slow Down, Verify, and Stay Secure

Slow down and verify before moving money in ways that can’t be reversed. Verify senders, preview links and never act on pressure. By making some small habit changes and adopting a few lightweight security tools, you can make sure the holidays stay joyful — and that scammers are left out in the cold.