November is synonymous with the Black Friday and Cyber Monday retail rush. While your business might be focused on Q4 goals or grabbing a great deal on new office equipment, cybercriminals are gearing up for their most profitable time of the year. They know that during the November rush, inboxes are overflowing, stress levels are high, and employees are distracted—creating the perfect environment for seasonal phishing scams to slip through the cracks.

The Fake Delivery Notification Scam

During November, almost everyone is expecting a parcel. Scammers heavily exploit this by sending thousands of fake delivery texts and emails pretending to be from Royal Mail, DPD, Evri, or Amazon.

• The Hook: The message usually claims that a parcel could not be delivered due to an unpaid shipping fee or an incorrect address, and provides a link to “reschedule” the delivery.

• The Trap: Because employees are genuinely waiting for Black Friday purchases or business supplies, they click the link without thinking. They are then directed to a flawless, cloned website designed to steal their credit card details or Microsoft 365 login credentials.

• The Fix: Train your team to never click links in unexpected delivery texts. If they are unsure about a package, they should open their web browser, navigate directly to the official courier’s website, and manually type in the tracking number they received when they placed the order.

The Urgent Supplier Invoice Fraud

Cybercriminals know that businesses process a high volume of transactions ahead of the Christmas period. To bypass standard spam filters, attackers use AI to craft highly convincing, plain-text emails pretending to be from one of your known suppliers.

• The Hook: The email mentions an outstanding invoice or an upcoming Black Friday hardware order, but casually notes that their bank details have recently changed.

• The Trap: Because the email looks exactly like a normal business conversation and contains no obvious malicious links, it easily sneaks past technical defences. If your finance team updates the payment details without verifying them, the money goes straight to the attacker.

• The Fix: Mandate a strict company policy that every single request to change supplier bank details must be verified by a phone call to a trusted, pre-existing number.

Maintain Your Human Firewall

Spam filters and antivirus software are essential, but they cannot catch every tailored seasonal threat. Your strongest line of defence is a vigilant team. Remind your staff to slow down, scrutinise unexpected requests, and always verify financial changes through a secondary channel, regardless of how urgent an email claims to be.

Don’t let a seasonal scam cost your business

Securing your small business doesn’t have to be overwhelming. If you want peace of mind knowing your inbox is protected and your team is trained, Novo IT is here to help. As a family-run business based in Crawley, we provide proactive Cybersecurity and Managed IT Services to small businesses across West Sussex. We can lock down your email security, implement Security Awareness Training, and monitor your network so you can navigate the busy holiday season safely.

👉 Ready to secure your digital presence? Book your Free IT Audit today, and let our expert, friendly team protect your business while you focus on growth.

Disclaimer: This article was created with the assistance of AI tools based on prompts and guidance provided by Novo IT Ltd.