The Holiday Scam That Cost One Company $60 Million (And How To Protect Yours)

Last December, an accounts payable clerk at a midsize company got an urgent text from her “CEO”: Buy $3,000 worth of Apple gift cards for clients, scratch the backs and e-mail the codes. It sounded odd, but the request came from the boss’s name, and it was peak holiday chaos. By the time she double-checked, the cards were gone, the scammer had cashed out and the business had eaten the loss.

That scam may sting, but others can cripple a business entirely. That same month, Orion S.A., a Luxembourg-based chemical manufacturer, fell victim to a far more devastating con. An employee received what appeared to be routine e-mail requests for wire transfers – likely from a trusted colleague or partner. The requests seemed legitimate, urgent and aligned with normal business operations. Without hesitation, the employee processed multiple transfers as instructed.

The result? Sixty million dollars sent directly to cybercriminals – more than half the company’s annual profits gone in a series of fraudulent wire transfers.

If you think your small business is too small to be a target, think again. Gift-card scams alone cost businesses over $217 million in 2023, and business e-mail compromise attacks accounted for 73% of all cyber incidents in 2024. The holidays are prime time for these attacks because criminals know your team is distracted, stressed and processing more transactions than usual.

5 Holiday Scams Your Employees Need To Know (Before They Cost You Thousands)

1. “Your Boss Needs Gift Cards” (The $3,000 Text Trap)

• The scam: Impostors pose as owners or managers and pressure staff into buying gift cards for “clients” or “employee appreciation.” In Q1 2024 alone, 37.9% of business e-mail compromise incidents were gift-card schemes.
  ‍
• Prevention: Company policy: No gift cards without two approvals. Train employees that executives will never request them via text.

2. Invoice & Payment Switch-Ups (The Big Money Play)

• The scam: Fraudsters send “updated banking details” or hijack vendor e-mail threads right when year-end bills are due. In June 2024, the Town of Arlington, MA, lost nearly half a million dollars this way.
  ‍
• Prevention: Confirm any banking changes with a known phone number, never the one in the e-mail. Adopt a “phone call rule” for all financial changes over $5,000.

3. Fake Shipping & Delivery Notices

• The scam: Phishing e-mails or texts pose as UPS/FedEx/USPS with links to “reschedule delivery.”
  ‍
• Prevention: Train staff to type the carrier’s site directly into the browser. Bookmark official tracking pages to avoid clickbait links.

4. Malicious “Holiday Party” Attachments

• The scam: E-mails with attachments like “Holiday_Schedule.pdf” or “Party_List.xls” that install malware when opened.
  ‍
• Prevention: Block macros, scan attachments and make verifying unexpected files part of your culture.

5. Bogus Holiday Fundraisers

• The scam: Phishing sites mimic charities or fake “company match” campaigns to steal money or data.
  ‍
• Prevention: Share an approved charity list and require all donations to flow through official portals.

Why These Attacks Work (And How To Stop Them)

The same tools that make business efficient – e-mail, online banking, digital payments – are exactly what scammers exploit. These aren’t “Nigerian prince” e-mails. They’re sophisticated attacks blending social engineering with research on your company.

Organizations that run regular phishing simulations reduce risk by 60%, yet most small businesses never train employees. Multifactor authentication blocks 99% of unauthorized logins, but many firms still rely on passwords alone.

Your Holiday Defense Checklist

Here’s what to do before the holidays hit full swing:

• ‍The Two-Person Rule: Any transaction above your set threshold requires verbal confirmation through a separate channel.
• ‍Gift Card Policy: Put in writing: No gift cards via e-mail or text.
• ‍Vendor Verification: Confirm all banking or payment changes by phone using numbers already on file.
• ‍Multifactor Authentication: Enable MFA on all e-mail, banking and cloud accounts.
• ‍Holiday Awareness: Brief your team on these five scams with real examples.

The Real Cost: More Than Just Money

While Orion’s $60 million loss made headlines, the hidden costs often hit small businesses harder:

• Operations grinding to a halt during peak season
• Productivity lost as staff scramble on cleanup
• Customer trust eroded if client data is compromised
• Insurance premiums spiking after a cyber incident

The average loss per business e-mail compromise incident is $129,000 – enough to sink many small businesses at the worst possible time of year.

Keep Your Holidays Merry, Not Messy

The holidays should be about growth and celebration, not cleaning up wire fraud. A staff huddle, a handful of smart policies and a few layered protections go a long way toward keeping criminals out of your books.

Remember: The employee at Orion could have stopped a $60 million loss with a single verification phone call. With the right awareness and simple checks, your business can avoid being the next cautionary tale.

Want to make sure your team is locked down before the New Year? Book a 15-minute discovery call with us and we’ll walk you through quick, practical steps to keep your business safe. Don’t let cybercriminals steal your holiday success.

Schedule Your Free Security Assessment

Because the best gift you can give your business this holiday season is peace of mind.