Written by Greg Schneider, Contributor, 2024
If you are the person your family calls when the printer stops working, congratulations: December is your busiest month, and the scammers know it. The holidays are their peak season too. More packages in transit, more money moving, more people tired, rushed, and generous — every condition a scam needs is worse in December than any other month of the year.
Here's what will be coming at your family over the next few weeks.
The package text. "Your delivery is delayed. Click here to reschedule." It arrives when you're genuinely expecting three packages, which is exactly the point. The link goes to a convincing copy of a carrier or postal site that asks for a small "redelivery fee" — and your card number, and everything else on the form.
The gift-card demand. A boss, a landlord, a "utility company," sometimes a grandchild in trouble — someone urgent insists you pay right now, and the only acceptable payment is gift cards, with the numbers read over the phone. Real organizations do not get paid in gift cards. Urgency plus gift cards is not a payment method; it's a signature.
The fake charity. December is when people give, so December is when fake charities bloom — names that sound one syllable off from the real ones, emotional photos, and pressure to donate before midnight. The cause is real. The organization isn't.
The impossible deal. The game console, the designer bag, the puppy — priced just low enough to make you move fast, on a storefront that was registered last Tuesday. You pay, nothing ships, and the site is gone by January.
The QR code. A sticker slapped over the real code on a parking meter, a restaurant table tent, a package pickup locker. You scan it, you land on a payment page that looks right, and your money goes somewhere else entirely. If a code looks layered, lifted, or just slightly wrong, type the address yourself instead.
Knowing the list helps, but lists don't protect anybody at 9 PM when a convincing text lands. What protects people is setup — done once, in advance, while nobody is panicking. Here is the setup to do for your family before the season gets any deeper.
The one-afternoon setup
Update everything. Phones, tablets, the laptop that only comes out for taxes. Turn on automatic updates and leave them on. A large share of the damage from scam links happens on devices running software with known holes. This is unglamorous and it works.
Turn on MFA and a password manager, together. Multi-factor authentication on email first — email is the master key that resets everything else — then banking, shopping, and social accounts. Pair it with a password manager so every account gets a unique password nobody has to remember or write on a sticky note. If your relative reuses one password everywhere, one leaked site hands a stranger the keys to all of them. Fix that once and it's fixed for good.
Agree on a family code word. Voice cloning is cheap and good now. Three seconds of audio — a voicemail greeting, a social media video — is enough to fake a voice your mother would swear is yours. So pick a word or short phrase nobody would guess, share it in person, and make one rule: any call asking for urgent money has to produce the code word, or the answer is no and we call back on the number we already have. A real family member will understand. A scammer will hang up.
Three questions before paying anyone anything
Teach these, because they work even when the scam is one nobody's seen yet:
- Did I start this, or did they? A message, call, or pop-up that arrived on its own is guilty until proven innocent. Go to the company directly — the app, the number on the card, the site you type yourself.
- Is the payment method weird? Gift cards, wire transfers, crypto, payment apps to a stranger — each one is chosen because it can't be reversed. Weird payment method, full stop.
- What happens if I wait an hour? Real problems survive an hour. Scams mostly don't, because the pressure is the product. Anyone who can't let you think is telling you what they are.
Screenshot this
- ☐ Devices updated, automatic updates ON
- ☐ MFA on email first, then bank, shopping, social
- ☐ Password manager installed, no reused passwords
- ☐ Family code word agreed — urgent money calls must say it
- ☐ Package texts: never tap the link; check the carrier app instead
- ☐ Gift cards are for gifts. Never for bills, fines, or bail
- ☐ Charity? Look it up and donate on its real site
- ☐ QR code looks tampered? Type the address yourself
- ☐ Three questions, every time: Did I start this? Is the payment weird? Can it wait an hour?
Do the setup once, while it's calm. Then when the December texts start landing — and they will — your family won't need to call you in a panic. They'll already know what to do.