How to Spot Holiday Phishing Scams

The package that never arrives is a holiday tradition nobody enjoys. The message telling you it is stuck, though, is often the bigger problem. From late November through early January, phones fill with delivery alerts, missed-parcel notices, e-card greetings and appeals from charities you have never heard of. Most are genuine. A few are built to look exactly like the ones that are, and the difference usually comes down to a handful of small details — plus one firm rule about clicking.

Why the season does half the work for scammers

In December, an unexpected "delivery failed" text does not feel strange. It feels like Tuesday. You ordered more than usual, you are waiting on several parcels, and you cannot always remember which store shipped with which carrier. Charities push harder at year end too, so a sincere-sounding donation request is not odd either.

Scammers borrow that context. Their messages do not have to be clever — they only have to land while you are carrying groceries with a phone in one hand and half an eye on the front door. A message that gets a two-second glance instead of a careful read is the entire attack.

Shipping notifications: the details that give them away

Legitimate carriers really do send texts and emails about deliveries. That is exactly why the fakes work. Watch for these markers:

• A link that doesn't go where it claims. On a phone, long-press the link; on a desktop, hover over it. Read the domain immediately before the first single slash. usps-delivery-help.com is not usps.com, and fedex.track-package.info is not FedEx.
• A small fee to "release" or "reschedule" a parcel. Carriers do not collect a one-dollar redelivery charge by text message and card payment.
• No matching order. You cannot remember buying anything, or the reference number brings up nothing on the carrier's own site.
• A short deadline. "Confirm within 12 hours or the parcel returns to sender" is a pressure tactic, not a policy.
• Requests for data. Full address, date of birth, card number, or a one-time code. That code is the whole point of the scam — it opens an account you already own.

Do not lean on bad grammar as your detector. Plenty of these messages are cleanly written, with correct logos and plausible tracking formats.

The test that settles almost every case

Ignore the message and go to the source. Open the carrier's app, or type the tracking number into the carrier's website yourself. If the shipment is real, it will be there. If nothing appears, the text was bait. This takes less time than rereading the message twice, and it works no matter how convincing the wording was.

A sixty-second check before you click

1. Do not click, and do not copy anything out of the message.
2. Open the retailer's order confirmation to see which carrier has your parcel.
3. Check the tracking number directly on that carrier's site or app.
4. Inspect the sender's full email address or phone number, not just the display name.
5. Ask whether you are expecting anything at all this week.
6. Never enter card details, passwords or one-time codes to "receive" a package.
7. Still unsure? Contact the retailer through the details you used before, not the ones in the message.

Charity fraud: the seasonal soft spot

Charity scams are harder to spot because they aim at generosity rather than habit. Year-end giving is genuine and worth doing, which is what makes a fake appeal so effective. The recurring shapes are predictable:

• A name that sounds almost like a well-known organization.
• A crowdfunding page for a named individual, with a photograph and a story but no verification.
• "A donor will double your gift if you give in the next three hours."
• Payment by gift card, wire transfer, cryptocurrency or a peer-to-peer app — methods that are hard to reverse.
• An unsolicited appeal tied to a headline, sent from a free email account.

A real charity will not insist on a gift card, will not dodge questions about where the money goes, and will not mind you checking it out first. If a fundraiser resists being verified, that is your answer.

How to vet a charity in a few minutes

• Search the official register and confirm the name matches exactly. In the United States that is the IRS Tax Exempt Organization Search; in the United Kingdom, the Charity Commission or OSCR in Scotland; in Canada, the CRA's charity list; in Australia, the ACNC register.
• Visit the organization's website by typing the address yourself, or call a number you found independently. Never use the link or number from the solicitation.
• Treat rating sites as a starting point rather than proof. They help you ask better questions, not skip them.
• Ask how much of a donation reaches programs. A legitimate organization can answer plainly.
• If you want to help one specific person, route the money through a registered charity or a trusted intermediary rather than sending it directly.

For questions about whether a donation is tax deductible in your situation, ask a qualified tax professional.

If you already clicked or paid

1. Change the password on any account whose details you entered, plus any account that reuses it. Turn on two-factor authentication.
2. Call your bank or card issuer using the number printed on your card. Report the charge and ask what can be done. Speed matters.
3. If you gave a one-time code, treat the account as compromised: sign out of all sessions, then change the password.
4. Report it. Forward the message to the carrier or retailer being impersonated, and file with your national fraud body. In the United States that is the FTC and the FBI's IC3; in the United Kingdom, Action Fraud. Keep screenshots and message headers.
5. If you shared identity details, contact the major credit bureaus and consider a credit freeze, which is free in the United States.

Getting scammed is not a character flaw. It means the message arrived at a busy moment. Reporting quickly is what limits the cost.

Make it a habit, not a December scramble

Three small habits cover most of the risk. Track your orders in one place so you know what is actually on the way. Treat every delivery link as suspect and go to the carrier directly instead. Give to charities by typing their address yourself, never through a link in a text or an unsolicited email.

Tell the people you live with, too. A shared note about which parcels are expected saves real confusion, and older relatives are frequent targets of both shipping and charity scams. If something feels off, it usually is — and checking costs you thirty seconds.

Photo: Tumisu / Pixabay