Tax deadlines and the winter holidays are the two busiest phishing seasons of the year, and they have more in common than you might expect. Both arrive with built-in urgency. Both hand a stranger a believable reason to ask you for money, a password, or a moment of inattention. And both land when your calendar is already full.
The emails themselves are rarely sophisticated. Most are recycled templates with a fresh logo and a new hook. What changes is the timing — and timing does a lot of the work for the attacker.
Why the calendar does half the work
A message about a tax refund or a parcel that never arrived is one of the few things people will open without stopping to think. The subject line matches something already on their mind.
The workplace side matters just as much. Finance teams are closing the year, invoices are piling up, approvals are being chased, and half the office is on leave. Fewer people are around to double-check an unusual payment request, and the ones who are left are moving faster than they would in March. That gap is exactly what invoice fraud and executive impersonation are built for.
Add the personal-professional blur. Many people check a work laptop for a delivery notice or read a work email on a phone at nine in the evening. Context collapses, and with it, scepticism.
Tax season: refunds, rejections and payroll
Tax-themed phishing usually arrives in one of three shapes.
The refund. A message says money is waiting but your details need confirming. The link opens a page that copies the tax authority's branding and asks for a login, a national ID number or card details. Real tax agencies do not ask you to claim a refund through an emailed link, and they never ask for payment in gift cards, vouchers or cryptocurrency.
The problem. A filing was "rejected", a document is "missing", a form must be signed today. Attached is a file you did not ask for — sometimes password-protected precisely because that stops email scanners from opening it. If the document was not expected, confirm it by phone before you touch it.
The payroll change. An email pretending to come from HR or a payroll provider asks employees to re-enter bank details, or asks the payroll team to update someone's account. The request looks routine and slightly boring, which is what makes it dangerous.
One habit neutralises most of it: never log in through a link in a message. Open the tax portal, the payroll system or the bank by typing the address yourself, or by using a bookmark you already trust.
Fake payment requests: the holiday favourite
December and early January produce a specific kind of fraud — the supplier who suddenly has new bank details. The email may reference a real invoice, a real project and a real contact name, because the sender has read a compromised mailbox or guessed the pattern. "Our account is being audited", "we've moved to a new finance system", "please update your records before the next payment". The story changes; the goal does not.
Then there is the executive request. A short message from a name you recognise, sent from a personal-looking address, asking for an urgent transfer or a stack of gift cards for "client rewards". The vouchers are the giveaway: no legitimate organisation pays a supplier, a bonus or a tax bill in prepaid gift cards, and the codes are gone the moment they are sent.
Delivery scams follow the same logic on the consumer side — a small "redelivery fee" to release a parcel, paid on a page that harvests card details. Small amounts keep the request plausible.
The red flags worth a second look
- The domain is almost right. An extra letter, a hyphen, a different ending. Read the actual address, not just the display name.
- The reply-to doesn't match the sender. A sign that the visible address is decoration.
- Urgency with a clock attached. "Within two hours", "today only", "before your account is suspended".
- A request for credentials, an MFA code or full card details. No help desk, bank or tax office needs these by email.
- New payment instructions. Any change to bank details, especially mid-conversation on an existing thread.
- Links that don't match their text. Hover first, or simply don't click.
- Unexpected attachments. HTML files, archives, or Office documents that ask you to enable macros.
- Emotional pressure. Fear of a penalty, respect for authority, or a story about a colleague in trouble.
And one signal you should stop relying on: bad grammar. Plenty of current campaigns are cleanly written and well designed. Spelling mistakes are a bonus clue, not a test.
What to do in the first five minutes
- Don't reply, don't click, don't forward it to colleagues. Forwarding spreads the link.
- Verify out of band. Call the person or the supplier on a number you already hold — never the one in the message. Ask the question that matters: "Did you send this?"
- Report it. Use the report-phishing button if your mail platform has one, and tell your IT or security team. One report can protect everyone else.
- If you clicked or entered details, say so immediately. Change the password from a different device, sign out other sessions, and let security watch for unusual logins. Speed matters more than embarrassment.
- If money moved, call your bank straight away — recall windows are short. Follow your organisation's incident process, and for anything tax-related, confirm the details directly with the agency or a qualified accountant rather than through the message.
Habits that hold up all year
The teams that handle these campaigns best don't rely on people memorising a list. They build a few rules that take the decision out of the moment.
Slow down in two situations: when money is mentioned, and when a login is requested. Those two cover most of the damage a phishing email can do. Keep a short list of suppliers and their verified phone numbers, so "call and check" is easy rather than a chore. Require a second approval for any change to payment details, with no exception for seniority — a senior executive asking to skip the check is itself a warning sign.
Send short reminders through the year using redacted examples from your own inbox. Messages your colleagues nearly fell for land harder than a generic slideshow. And make reporting painless and blameless: if people expect a telling-off, they will quietly delete the evidence instead of handing it to the person who could contain it.
Finally, treat the process as something to test rather than describe. A simple drill — a suspicious email arrives, someone reports it, the team confirms whether it was real — tells you far more than a quiz score. The goal isn't to turn everyone into a security analyst. It's to make "stop, verify, report" the reflex when the calendar is crowded and the request sounds urgent.
Photo: Mikhail Nilov / Pexels