Holiday Phishing Scams 2026: Fake Shipping Notices, Gift Card Requests and Delivery Texts

Last updated: November 3, 2026

Every November the same three messages start landing in Portland-area inboxes and phones: a shipping notice for a package nobody remembers ordering, a quick text “from the boss” asking someone to grab gift cards, and a delivery alert saying a package can’t be dropped off until you confirm your address. They work because they look exactly like the real holiday traffic everyone is already drowning in.

None of these scams are new. What changes each season is the volume and the polish. AI writing tools make the grammar clean, the logos are copied straight from real carriers, and the timing lines up with the weeks when your team is busiest and least likely to slow down. Here is what each one looks like, why it works, and the simple habits that stop it.

Scam 1: The fake shipping notice

What it looks like: An email that appears to come from a major carrier or a big online store. “Your order has shipped,” “Delivery exception,” or “Action required: update your shipping details.” There is a tracking button, and sometimes a PDF or HTML attachment that “contains your label.”

Why it works: During the holidays almost everyone has something in transit, for the office or at home. A shipping email doesn’t feel unusual, so people click on autopilot.

What it’s really after: The button usually leads to a login page that steals a Microsoft 365 or Google password, or to a fake payment page asking for a small “redelivery fee.” Attachments can carry malware.

How to stop it:

• Never use the link in the email. Open the carrier’s site or app yourself and paste the tracking number, or check the order in the store account you actually used.
• Treat unexpected HTML or ZIP attachments as dangerous. Real shipping notices don’t need them.
• Look at the sender’s full address, not just the display name. A carrier name with a random free email domain is a giveaway.

Scam 2: The gift card request “from the boss”

What it looks like: A short email or text that seems to come from the owner or a manager. “Are you at your desk? I need a quick favor.” A few messages later: “I want to surprise the team. Can you pick up some gift cards and send me photos of the codes? I’m in meetings all day.”

Why it works: It plays on helpfulness and on not wanting to bother a busy boss. Holiday gift cards for staff sound completely normal in December, and the “I’m in meetings” line is there to stop you from calling to check.

What it’s really after: The gift card codes. Once someone sends the photos, the money is gone and there is almost never a way to get it back.

How to stop it:

• Make it a written company rule: nobody buys gift cards, changes bank details or sends money based on an email or text alone. Ever.
• Verify by calling the person on a number you already have, not one in the message. A real boss won’t mind.
• Tell your team this scam exists before it shows up. People who have heard about it once tend to spot it right away.

This is a close cousin of the payroll diversion scam and invoice payment fraud: same trick, different ask.

Scam 3: The package-delivery text

What it looks like: A text message: “Your package is on hold due to an incomplete address. Update here within 24 hours,” followed by a short link. Some versions claim a customs fee or a missed delivery attempt.

Why it works: Phones hide the details that make email scams easier to spot. The link is short, the sender is just a number, and people read texts while walking, driving or juggling customers.

What it’s really after: Card numbers, personal details, and sometimes a login to whatever account the person reuses that password on. If the phone is also used for work email, a stolen password can become a business problem fast. See our post on credential stuffing and leaked passwords for how one reused password spreads.

How to stop it:

• Carriers don’t ask you to pay fees or “confirm your address” through a random text link. Check the carrier’s app or site directly.
• Don’t reply, even with STOP, to a number you don’t recognize. Delete it and report it as junk.
• Keep work email and company apps behind multi-factor authentication (MFA) so a stolen password alone isn’t enough.

Five habits that cover all three

You don’t need a different defense for every scam. A few habits handle most of them:

1. Go to the source. Open the site or app yourself instead of clicking the link you were sent.
2. Verify money and gift card requests by phone, using a number you already trust.
3. Slow down when a message says “urgent.” Pressure is the scammer’s main tool.
4. Turn on MFA for email, banking and any system that holds customer data.
5. Make reporting easy and blame-free. If someone clicked, you want to hear about it right away, not after they’ve worried about it for a week.

What a managed IT provider adds

Habits matter most, but the right tools catch a lot before your team ever sees it. At PDX Information Technology Services, our managed plans include email filtering that flags lookalike senders and dangerous links, MFA set up across your accounts, security awareness training so staff recognize these scams, and a team to call when something looks off. If someone does click, we help lock the account, reset passwords and check what was touched. You can read more on our cybersecurity services page, and if you think a mailbox has already been compromised, start with our guide on what to do after a business email breach.

Our managed IT plans are Gold, starting at $100 per user, per month, and Platinum, starting at $180 per user, per month, with a 90-day opt-out: if it’s not a fit in the first 90 days, you can cancel with no penalties.

Get your team ready before the rush

The holiday season is the busiest time of year for these scams, and a single gift card mistake or stolen password can cost far more than an hour of prep. If you’d like help setting up filtering, MFA or a quick phishing refresher for your staff, contact PDX IT or call 971-331-4871. We’re based in Tualatin and support small businesses across Portland, Lake Oswego and the surrounding area, Monday through Friday, 7 AM to 6 PM.