Article Read Time
Deloitte’s 2026 Holiday Shopping Scams survey found that American households expect to spend an average of $1,654 this season, up 4 percent from last year, and more than half of them plan to buy gift cards. That money moves through the same shops, websites, and inboxes that criminals watch most closely between Thanksgiving and New Year’s Day. For a hardware store in Glasgow or a boutique in Paducah, the January rush that pays the bills is also a risky stretch. Staff are tired, orders are stacking up, and nobody has time to second-guess an odd email.
The FBI’s Internet Crime Complaint Center reported that losses passed $20 billion in 2025, the first year they crossed that mark. More than $3 billion of that was lost to business email compromise, a scheme in which a criminal poses as a boss, vendor, or customer to redirect money. Non-payment and non-delivery fraud, where goods are paid for and never arrive or goods ship and are never paid for, ranked among the three most common complaints. None of these schemes is new, which is good news for owners, because the defenses are well known and most of them cost nothing.
The Holiday Shopping Scams risks facing sellers
Fraudulent orders lead the list for any business that sells online. Criminals use stolen card numbers to buy gift cards or costly items, often shipping them to an address that doesn’t match the billing address. The business then absorbs the chargeback when the bank pulls the money back weeks after the goods are gone. Some criminals first run dozens of tiny test purchases to learn which stolen cards still work, so a sudden run of $1 orders is often the first warning a shop gets.
Gift cards carry their own risks at the counter. Criminals peel back the packaging on cards hanging in the store, record the numbers, and reseal them, then drain the balance the moment a real customer activates the card at the register. A display rack placed where staff can see it all day does more good here than any piece of software.
Impersonation is the third concern, and it is growing. Chase reported that nearly half of the scams its customers reported in 2025 started on social media. A fake page using a real shop’s name and photos can take orders and payments that never reach the owner. The customer blames the business, and the owner often learns about the copycat from an angry phone call in late December.
The Holiday Shopping Scams risks that come in with the staff
Employees shop for gifts too, and many of them do it on work computers and phones during a lunch break. A fake delivery text claiming a package is held up, or an email offering 80 percent off a sold-out toy, works just as well on a work laptop as on a home one. The password typed into the fake page may also be the one that opens the office email. NordVPN reported a 250 percent jump in fake shopping sites during the 2025 season, and those sites are built to look as ordinary as the real thing.
The gift card request from the boss remains the season’s most reliable con. A message that appears to come from the owner, the executive director, or the county judge-executive asks a staff member to buy several gift cards for client gifts and send photos of the backs. Because holiday gift-giving is normal, the request does not look strange. Once the numbers are sent, the money is gone for good.
What to do this season
The steps below are for small businesses, local governments, and non-profits, and none require a large budget or an outside vendor.
- Set a firm rule that no one buys gift cards, changes payment details, or sends money because of an email or text alone, and confirm every such request by calling a number already on file.
- Hold online orders that ship to a different address than the billing address, ask for a large quantity of gift cards, or arrive in clusters of small charges, and review them before anything ships.
- Keep gift card displays within sight of the register, and check each card’s packaging for tears, stickers, or exposed numbers before the sale goes through.
- Search Facebook and Instagram for your business name once a week through the holidays, and report copycat pages to the platform as soon as you find them.
- Ask staff to keep personal shopping off work devices and work email, and turn on multifactor authentication, which means a second login step beyond a password, for email and payment accounts.
- Brief seasonal hires on these scams during their first shift, since new employees are the least likely to question a request that seems to come from the boss.
If something goes wrong
Speed matters more than anything else once money has moved. Call the bank or card processor the same day and ask it to contact the receiving institution. Then file a report with the FBI’s Internet Crime Complaint Center at ic3.gov, whatever the amount. Also report gift card fraud to the company that issued the card, using the phone number printed on the card itself rather than one found in a search result.
Commonwealth Sentinel works with Kentucky businesses, local governments, and non-profits on staff training and email protection, and we are glad to talk through a season’s risks with anyone who calls 502-234-5554. During the busiest weeks of the year, the most useful habit a shop can build is a single phone call that slows a strange request down long enough to see it plainly.