Holiday Scams 2026: Watch How They Want to Be Paid

Every year the holiday warnings pile up as a list of separate scams, and every year the list gets longer. Fake stores. Fake tracking texts. Fake charities. Gift cards emptied on the rack before anyone buys them. It’s a lot to hold in your head while you’re also trying to find a size-small coat that ships before the 20th.

So this guide does it the other way round. It covers the five plays you’re most likely to meet between now and New Year’s, but it hangs all of them on one question you can ask in two seconds: how does this person want my money?

Some scale first. Online purchase scams were the single most reported scam type to the Better Business Bureau last year, 28.4% of everything people logged, and 89.3% of those reports involved someone actually losing money, according to BBB’s 2025 Scam Tracker Risk Report. The median loss was $68, which is exactly the size of a holiday gift. The FBI’s Internet Crime Complaint Center logged 56,478 complaints about goods that were paid for and never arrived, with $503 million in reported losses, in its 2025 annual report. Those are only the people who reported.

Seven holiday red flags, roughly in order of how fast they cost you

If you only read one section, read this one. Any one of these is a reason to stop and check through a route you found yourself.

1. Someone asks for gift card numbers, or a photo of the back of a card. This is the fastest loss on the list, because the money is gone the moment the numbers leave your phone. The FTC’s wording is blunt: “No real business or government agency will ever tell you to buy a gift card to pay them.”
2. A seller will only take Zelle, Venmo, Cash App, a wire, or crypto. Especially when the price is good and the seller found you, through a social ad or a marketplace message.
3. A “delivery problem” text with a link and a small fee. Redelivery charges of a dollar or two are bait. The fee isn’t the point. Your card number is.
4. A charity that can only take cash, gift cards, a wire, or crypto. The FTC says not to donate to anyone who insists on those, because legitimate charities take money in plenty of ways.
5. A message from “your boss” asking for an urgent favor. In December the favor is usually gift cards for clients or staff, bought today, numbers texted back.
6. A gift card whose packaging looks re-glued, or whose PIN strip is already scratched. Someone may have copied the number before you got there.
7. A store you’d never heard of until an ad found you, with prices well under everyone else’s. Particularly for whatever is sold out everywhere else this year.

Notice that five of the seven are about payment. That’s the whole argument of this post.

The payment is the tell

Scam stories change every season. This year’s include AI-written store pages and charity appeals tied to whatever disaster is in the news. What doesn’t change much is the last step, because the criminal needs money that moves fast and can’t be pulled back. That narrows the menu to a handful of options: gift cards, wires, payment apps sent to a stranger, crypto, and cash handed to a courier.

Government agencies say this almost word for word. The FBI’s September 17 warning about people impersonating police and officials, a scheme it ties to nearly 61,000 complaints and more than $1.6 billion in losses between January 2025 and July 2026, says that “law enforcement and government officials will never request payment via prepaid cards, cryptocurrency, or courier.” The FTC’s gift card guidance puts it in five words: “Gift cards are for gifts.” And its August charity alert lists the same methods as the warning sign for fake fundraisers.

So the habit worth building, for you and for anyone in your family who shops online, is to look at the payment step before you look at anything else. A legitimate store takes a credit card at checkout. A real charity will take a card or a check made out to the organization. Your actual manager can wait twenty minutes while you call them back. When the payment method is the one thing they won’t budge on, you have your answer, however good the rest of the story is.

Figure 01 · How they want to be paid ScamDrill

Sources: FTC gift card guidance; FTC charity alert, 27 August 2026; FBI IC3 PSA, 17 September 2026; FTC alert on fake-boss gift card requests, January 2026.

One honest caveat. A credit card at checkout doesn’t make a fake store real. It just leaves you with a dispute process if the order never shows up, which a gift card or a payment-app transfer to a stranger usually doesn’t. That’s why the payment check comes first: it decides how bad a mistake can get.

Fake stores and the gift that never ships

This is the biggest of the five by volume. Somebody sees an ad on Facebook, Instagram or TikTok for the thing that’s sold out everywhere else. The site looks fine. Sometimes it looks better than fine, because cloning a real store’s product pages takes minutes now, which we walked through in our piece on cloned dealership websites. The order goes through and a confirmation email arrives. Then nothing.

Sometimes there’s a fake tracking number that never updates. Sometimes a cheap substitute shows up, close enough that the seller can claim it delivered. The IC3 files most of this under “non-payment/non-delivery,” and the $503 million figure above is that category for 2025.

What helps, roughly in order of effort:

• Type the store’s address yourself rather than tapping the ad. If you can’t find the same deal on the brand’s own site, be suspicious of the ad.
• Pay with a credit card, never a payment app or wire, at a store you don’t know. If the checkout steers you to Zelle or crypto “for a discount,” close the tab.
• Search the store name plus “scam” or “reviews” before you buy, and look at reviews somewhere other than the store’s own page.
• Be wary of a site that seems to have appeared this month with a huge inventory and no history anywhere else.

Big sale events make this worse, because real retailers are also sending “deal” emails and texts at the same time. Our October scam trends roundup covers the Prime-days wave and the fake order-confirmation texts that tend to follow it.

The “we couldn’t deliver your package” text

From November on, nearly everyone has a package in transit, so a delivery text doesn’t need to be clever. It needs to arrive. The usual form: your package is held, the address is incomplete, pay a small redelivery fee or confirm your details at this link. The link leads to a page dressed as the carrier that collects your card number, and sometimes the one-time code your bank texts you while you’re on the page.

We’ve covered this one in depth in our guide to USPS delivery text scams, including how to track a real package without touching the text. The short version: carriers’ tracking pages work fine when you go to them directly, so do that. Don’t tap links in delivery texts, and never pay a “fee” to get a parcel released.

There’s a related surprise that shows up this time of year, too: a package you didn’t order, sometimes with a card inside inviting you to scan a QR code to see who sent your “gift.” That’s a brushing package, and the QR card is the dangerous part.

The gift card that was empty before you bought it

This one is different from the rest of the list, and it’s the reason the gift card section is longer than the others. Here nobody talks you into anything. You do everything right, buy a gift card at a real store, load it with real money, and give it to your nephew. When he tries to use it, the balance is zero.

It’s called card draining, and it’s organized. In December 2025 the Texas Financial Crimes Intelligence Center arrested three men it suspects of gift card fraud estimated at $14 million. They had more than 400 gift cards on them when they were arrested. According to the release, they took unactivated cards from store racks, copied the numbers, resealed the packaging and put the cards back, and they told investigators they hit about ten stores a day, seven days a week, since May 2025. Texas made gift card tampering its own felony on September 1, 2025, and the arrests have kept coming. In September 2026 four more people were arrested in Sugar Land and Tyler over altered cards tied to more than $100,000 in potential losses, local reporting says.

The methods vary a bit. A June 2026 Forbes overview describes three: reading the card number with a cheap handheld scanner and checking the issuer’s balance line until it’s loaded; sticking a barcode the crew controls over the real one, so your money goes onto their card at checkout; and scratching off the PIN cover and recording it. The same piece quotes a Homeland Security special agent estimating that about 1,000 people nationwide are involved.

Figure 02 · How a gift card is drained ScamDrill

Method and scale: Texas Financial Crimes Intelligence Center news release, 22 December 2025; barcode-overlay and PIN methods per Forbes, 8 June 2026. Amber marks the criminal’s move, red the point of loss, blue your move.

You can’t fully protect yourself from a crew that has already been through the rack, but you can make yourself a much worse target:

• Buy from behind the counter, or buy a digital gift card from the retailer’s own website or app, instead of taking one off an open rack.
• Look at the packaging before you pay. The Texas investigators’ tip is to check for excess glue or damage. Make sure the PIN cover is intact and that there’s no sticker over the barcode.
• Keep the receipt and the card packaging until the recipient has used the card. The issuer will want both.
• Tell the person you gave it to that it’s worth using soon, and check the balance yourself if you’ve held it for a while.

If you find a drained card, call the issuer with the receipt in hand. The FTC keeps a list of issuer fraud lines, and the number is usually on the back of the card too. Whether you get the money back depends on the issuer, so don’t count on it.

Fake charities in giving season

December is when a lot of households do most of their giving, and scammers know it. Fake charities tend to borrow two things: a name that sounds like one you know, and whatever is in the news, whether that’s a hurricane, a wildfire or a sick child who went viral.

The reported numbers are small. The IC3 counted 662 charity fraud complaints and $7.9 million in losses in 2025. My read is that this undercounts badly, because people rarely find out a donation went nowhere, and the ones who do find out mostly don’t report it. Either way, the FTC’s August alert gives the checks that matter:

• Don’t give to anyone who says you can only pay by cash, gift card, wire or crypto.
• Don’t assume a fundraiser is legitimate because a friend shared it.
• If a text asks for a donation, confirm the number on the charity’s own website first.
• Look the organization up on Give.org or Charity Watch, and find out how much of the money reaches the cause.

The simplest version: give through the charity’s own website, which you typed in, with a card. If someone is on the phone pressing you to give right now, that pressure is itself worth noticing. Real charities would rather have your money next week than not at all.

In an election year the same check covers political giving. The FBI’s October warning about fake PACs and a phony “campaign investment pool” is in our guide to midterm election scams.

At work: the “boss” who needs gift cards for clients

If you run a small business or work at one, this is the holiday play to warn your team about this week. It usually opens with a text or email from someone posing as the owner or a manager, asking for an “urgent favor.” Then comes the ask: go to the store, buy gift cards, scratch off the backs, and send the numbers. The FTC wrote about it in January, noting that some versions now say “Google certificates” instead of gift cards to slip past people who’ve heard the warning.

The holidays give it cover. Client gifts and staff thank-yous are a real thing in December, so a request for a stack of gift cards doesn’t sound odd, and the “boss” is always conveniently stuck in meetings and can’t take a call. It hits small offices hardest, where the person getting the text knows the owner personally and doesn’t want to seem difficult.

Two rules fix most of it, and they’re worth saying out loud at the next staff meeting rather than burying in a handbook:

1. Nobody here buys gift cards because of a text or email. A request like that gets confirmed by calling the person on a number you already have, never by replying to the message.
2. Asking is never a problem. Say plainly that no one gets in trouble for checking, even if the request turns out to be real and the boss is mildly annoyed.

The same pattern, a trusted name plus urgency plus a payment that can’t be reversed, runs through most attacks on small businesses, from invoice fraud to payroll diversion. Our overview of social engineering aimed at small businesses covers the wider family. If you’d like your team to see a realistic version of this text before the real one arrives, that’s exactly what ScamDrill’s simulations for organizations are for.

A word about older relatives

The holidays are also when families are in the same room, which makes them a good time for the conversation nobody enjoys starting. People over 60 reported $7.7 billion in losses to the IC3 in 2025 across 201,266 complaints, both sharply up on the year before. A lot of those cases end the way the FBI’s September warning describes: a phone call from someone claiming to be a grandchild, a bank or the government, and then a demand for prepaid cards, crypto or cash handed to a courier.

You don’t need a lecture. One rule tends to land: if anyone asks you to pay with a gift card, it’s a scam, every time, no matter who they say they are. If you want something to leave behind, our page on the three calls that do most of the damage to older adults has a printable sheet for next to the phone. A family safe word is worth setting up while everyone’s at the same table, too.

If you already paid

Move quickly, and don’t spend energy on blame. These scams are built by people who do this all day, and they work on careful, smart people every single season. What you can recover depends almost entirely on how you paid and how fast you call.

• Gift card: call the card’s issuer right away, however long ago it happened, and ask whether any balance is left that they can freeze. Keep the card and the receipt. The FTC’s list has the fraud lines for Amazon, Apple, Google Play, Target, Walmart, Visa, Vanilla and others.
• Credit or debit card: call the number on the back of the card, report the charge as fraud, and ask about a dispute.
• Bank transfer, Zelle or wire: call your bank immediately and ask them to try to recall the payment. Speed matters more here than anywhere else.
• Report it at ReportFraud.ftc.gov, and to the FBI at ic3.gov for an online purchase that never arrived.

Our first-60-minutes checklist walks through the whole hour in order. And be ready for what often comes next: a message offering to get your money back for a fee. That’s the second scam, and it targets people who just reported the first one.

What to do now

Before the shopping really starts, it’s worth ten minutes to agree on a few house rules with the people you shop for and with:

• We don’t pay anyone in gift cards, ever. Gift cards are for gifts.
• We don’t tap links in delivery texts. We open the carrier’s site or app ourselves.
• At a store we don’t know, we pay by credit card or we don’t buy.
• We give to charities through their own websites, not through a caller or a text.
• If something feels off, we ask someone. Asking is never embarrassing.

Rules help. Practice helps more, because the real thing never arrives labeled. ScamDrill sends realistic, harmless practice scams to the people you care about, including delivery texts, fake order confirmations and gift card requests, and shows them what they missed when they click. It’s a calmer way to learn this than finding out at checkout.