That scam may sting, but others can cripple a business entirely. That same month, Orion S.A., a Luxembourg-based chemical manufacturer, fell victim to a far more devastating con. An employee received what appeared to be routine e-mail requests for wire transfers – likely from a trusted colleague or partner. The requests seemed legitimate, urgent and aligned with normal business operations. Without hesitation, the employee processed multiple transfers as instructed.
The result? Sixty million dollars sent directly to cybercriminals – more than half the company’s annual profits gone in a series of fraudulent wire transfers.
If you think your small business is too small to be a target, think again. Gift-card scams alone cost businesses over $217 million in 2023, and business e-mail compromise attacks accounted for 73% of all cyber incidents in 2024. The holidays are prime time for these attacks because criminals know your team is distracted, stressed and processing more transactions than usual.
The scam: Impostors pose as owners or managers and pressure staff into buying gift cards for “clients” or “employee appreciation.” In Q1 2024 alone, 37.9% of business e-mail compromise incidents were gift-card schemes.
Prevention: Company policy: No gift cards without two approvals. Train employees that executives will never request them via text.
The scam: Fraudsters send “updated banking details” or hijack vendor e-mail threads right when year-end bills are due. In June 2024, the Town of Arlington, MA, lost nearly half a million dollars this way.
Prevention: Confirm any banking changes with a known phone number, never the one in the e-mail. Adopt a “phone call rule” for all financial changes over $5,000.
The scam: Phishing e-mails or texts pose as UPS/FedEx/USPS with links to “reschedule delivery.”
Prevention: Train staff to type the carrier’s site directly into the browser. Bookmark official tracking pages to avoid clickbait links.
The scam: E-mails with attachments like “Holiday_Schedule.pdf” or “Party_List.xls” that install malware when opened.
Prevention: Block macros, scan attachments and make verifying unexpected files part of your culture.
The scam: Phishing sites mimic charities or fake “company match” campaigns to steal money or data.
Prevention: Share an approved charity list and require all donations to flow through official portals.
The same tools that make business efficient – e-mail, online banking, digital payments – are exactly what scammers exploit. These aren’t “Nigerian prince” e-mails. They’re sophisticated attacks blending social engineering with research on your company.
Organizations that run regular phishing simulations reduce risk by 60%, yet most small businesses never train employees. Multifactor authentication blocks 99% of unauthorized logins, but many firms still rely on passwords alone.
Here’s what to do before the holidays hit full swing:
While Orion’s $60 million loss made headlines, the hidden costs often hit small businesses harder:
The holidays should be about growth and celebration, not cleaning up wire fraud. A staff huddle, a handful of smart policies and a few layered protections go a long way toward keeping criminals out of your books.
Remember: The employee at Orion could have stopped a $60 million loss with a single verification phone call. With the right awareness and simple checks, your business can avoid being the next cautionary tale.
Book a 15-minute discovery call with us and we’ll walk you through quick, practical steps to keep your business safe. Don’t let cybercriminals steal your holiday success.
Schedule Your Free Security Assessment. Because the best gift you can give your business this holiday season is peace of mind.
Complete this form to get started and we will contact you to discuss the next steps. Or call us at 1-833-231-6182 to get started.
You wouldn’t drive without a seat belt. You wouldn’t leave your office unlocked overnight. So why go online without multifactor authentication (MFA)? MFA is like
Last updated: October 21, 2025 Request Your Free IT Compliance Assessment Introduction IT compliance for Nova Scotia businesses requires navigating federal PIPEDA regulations, provincial PHIA
In 2020, a family in Mississippi woke up to a nightmare. Their eight-year-old daughter heard a man’s voice coming from her bedroom, but it wasn’t
