December is the month when your inbox gets busier and your attention gets thinner. Packages are moving, budgets are closing, and half the team is answering email from a kitchen table or an airport gate. That combination is exactly what phishing campaigns are built for. The messages arriving now are not obviously malicious; they look like the ordinary year-end admin you already expect — a delivery update, a supplier invoice, a charity appeal from a colleague's fundraising page.

This checklist is written for remote and hybrid teams. Read it once yourself, then share the parts that matter with the people who approve payments or handle shipping on your behalf.

Why December Rewrites the Rules

Phishing works on context, not cleverness. An attacker does not need a brilliant lure if the message matches what you are already waiting for.

• Shipping volume spikes. If you ordered something last week, a delivery notice feels plausible.
• Approvals get slow. When your finance lead is on leave, "urgent, please pay today" lands on someone who does not want to be the bottleneck.
• Staffing thins out. Help desks, IT, and vendors run on skeleton crews, so verification takes longer and people skip it.
• Temporary workers join. Seasonal staff often have less context about what normal looks like.
• People travel and work from personal devices. Updates lag, saved passwords multiply, and home Wi-Fi replaces the office network.

None of these are new risks. December just stacks them on top of each other.

Three Scams to Expect, and How They Actually Look

1. Fake shipping notices

The pattern is consistent: a delivery you are not expecting, a fee you have never paid before, and a link that wants a card number or a login. Watch for:

• Domains that imitate a carrier with extra words or hyphens — redelivery-fedex-help.example rather than the carrier's own domain.
• A message that says "reschedule your delivery" but never includes a real tracking number.
• A small charge, usually a few dollars, described as a customs fee or redelivery cost.
• Text messages with shortened links and no order details. Smishing rises alongside parcel volume.
• Attachments in .html or .zip pretending to be a delivery label.

If you are unsure, do not click. Open the carrier's site in a new tab and paste the tracking number from the retailer's confirmation email instead.

2. Invoice and payment fraud

Year-end invoicing gives attackers cover. The most damaging version arrives mid-way through a real thread, or looks like an innocent note about updated bank details from a supplier you genuinely use. Red flags:

• A change to payment instructions, especially with a new bank or a new account name.
• Reply-to addresses that differ from the sender address by a single character.
• Pressure to pay before year-end close, or a threat that a service will be suspended.
• An executive asking for gift cards or an urgent wire, with a request to keep it quiet.

Verify every payment change by phone using a number from your own vendor records — never the number written in the email.

"Before I process this, I'm going to call the vendor on the number we already have on file."

That sentence should be normal, not awkward. Say it out loud in team meetings so nobody feels odd using it.

3. Charity and gift-card phishing

Giving season brings a wave of appeals, and most are genuine. The fakes lean on emotion and urgency. Be cautious when a donation page uses a domain that only resembles the charity's name, when payment is requested by gift card, cryptocurrency, or a peer-to-peer transfer to an individual, or when a colleague's "fundraiser" arrives from an address you have never seen. Check the charity through the official regulator in your country, or go directly to the organisation's website by typing the address yourself. If you want to give, give on your own terms and your own timeline.

The December Checklist for Every Remote Worker

1. Treat urgency as a warning sign. If a message demands action in minutes, that is your cue to slow down.
2. Read the domain, not the display name. Display names are free to fake; the domain is where the truth lives.
3. Hover or long-press every link. Check the domain immediately before the first single slash.
4. Never log in from a link. Open the app or type the address yourself, then continue there.
5. Verify money separately. Any new bank detail, invoice, or refund gets a voice call to a known number.
6. Keep donations on trusted payment rails. Card or a known platform, not gift cards or crypto to an individual.
7. Be suspicious of attachments you did not ask for. Invoices rarely need to arrive as .zip or .html files.
8. Report anything odd, even if you clicked. Speed protects the team; embarrassment protects nobody.

What Managers and IT Should Set Up Before the Break

Individual caution only goes so far. A few structural moves make the whole team harder to trick.

• Agree one out-of-band rule for payment changes, with no exceptions — not even from the CEO.
• Require dual approval for vendor banking changes, and consider a freeze window over the quietest days.
• Make the reporting channel obvious: one address, one chat channel, and a clear after-hours route.
• Turn on multi-factor authentication everywhere, and use hardware keys for finance and admin accounts.
• Tell people that slow replies are acceptable. Fear of being the blocker is what pushes someone to approve a fake invoice.
• Run a short drill: send a harmless test message and see how quickly it gets reported. Fix the gaps while nothing is at stake.

If Someone Clicks: The First Thirty Minutes

Response matters more than blame. Move quickly and in this order.

1. Report it through the agreed channel and note the time.
2. If credentials were entered, change the password and revoke active sessions.
3. Check account settings for new forwarding rules, inbox rules, or added MFA devices.
4. If payment details changed or a transfer went out, call your bank and the vendor now. Recovery windows are short.
5. Keep the original message. Do not delete the evidence.
6. If a personal device was involved, update the system and run a scan before using it for work again.

For anything involving money, contracts, or a possible data breach, bring in your finance, legal, or compliance advisors early rather than improvising. They will know your obligations and your deadlines.

Close the Year with Quieter Habits

You do not need a security overhaul to get through December. You need a handful of habits that survive contact with a busy inbox: verify money out of band, log in only through doors you opened yourself, and report fast. Pin the checklist in your team channel, mention it once in a standup, and make sure everyone knows who to tell when something feels off. A calm, well-verified December beats a heroic cleanup in January.

Photo: StefanHoffmann / Pixabay