Holiday and Seasonal Phishing Alert Guide

Phishing lures follow the calendar. Tax deadlines, insurance enrollment windows, holiday shopping, and year-end giving each give attackers a believable reason to send a message, and people expect a flood of legitimate notices at exactly those times. APWG’s Phishing Activity Trends Report for Q4 2025 notes, for example, that phishers timed some QR-code attacks to Black Friday week, “when users may place heightened trust in order, delivery, and payment notifications.”

A seasonal lure is not the same as a seasonal surge, though. APWG counted 853,244 phishing attacks in Q4 2025, 4% fewer than in Q3, and phishing/spoofing was the most-reported crime type in the FBI’s 2025 Internet Crime Report, with 191,561 complaints across the whole year. The calendar below tells you which disguise to expect; the defenses apply all year.

The Seasonal Phishing Calendar

January-April: Tax Season

IRS impersonation: Fake IRS emails, texts, and calls demanding immediate payment, threatening arrest or audit, or “verifying” details for a refund. The IRS says it never emails or texts without your permission and never sends direct messages on social media. It may phone about an account, but it never calls to demand payment now, threaten arrest, or tell you about a refund.
Tax preparer impersonation: Fake messages from “your CPA” requesting sensitive documents or W-2 data
Refund phishing: “Your tax refund is ready: verify your identity to receive it”
W-2 phishing targeting employers: BEC attacks asking HR or payroll staff for employees’ W-2 data; the IRS directs these to IC3
Fake tax services: Lookalike sites for tax software and IRS services that harvest logins and Social Security numbers

Defense: Forward IRS-impersonation emails to [email protected] with “IRS” or “Treasury” in the subject line, then delete them. Report IRS-impersonation calls to the Treasury Inspector General for Tax Administration (TIGTA) at 800-366-4484. Verify tax communications through your preparer’s known phone number or IRS.gov directly. See our tax scam guide.

May-August: Summer Travel and Back-to-School

Travel booking scams: Fake airline, hotel, and vacation rental sites; verify bookings through official channels
Fake Wi-Fi at travel destinations: Evil twin attacks at airports, hotels, and cafes
Back-to-school scams: Fake school supply deals and “mandatory” technology purchases
Education-targeted phishing: Fake enrollment portals and financial aid messages

October-January: Open Enrollment

Insurance enrollment windows produce a burst of legitimate plan mail that attackers copy. Medicare’s Open Enrollment Period runs from October 15 to December 7, and the HealthCare.gov Marketplace Open Enrollment runs from November 1 to January 15. Many employers also hold benefits enrollment in the fall.

Fake plan and insurer login pages: “Confirm your coverage” or “your plan will lapse” messages leading to credential harvesting pages. Reach the federal Marketplace by typing HealthCare.gov (or your state’s own marketplace address) rather than following a link.
Benefits enrollment phishing: Fake HR or benefits-portal messages sent to employees during corporate open enrollment
Insurer impersonation: In June 2025, the FBI warned that criminals were posing as health insurers and their “investigative team members” to obtain medical records, financial details, and payments

November-December: Holiday Shopping and Year-End Giving

Package delivery phishing: Fake USPS, FedEx, UPS, and Amazon delivery notifications. The US Postal Inspection Service says USPS does not send texts or emails unless a customer requested the service with a tracking number, and those messages do not contain links. See our package delivery scam guide.
Retail impersonation: Fake sale alerts from major retailers with “too good to be true” deals
Non-delivery scams: Fake shops that take payment and never ship; IC3 recorded 56,478 non-payment/non-delivery complaints and $503 million in losses in 2025
Gift card scams: Fake gift card activation pages, “free gift card” offers, and “urgent” gift card requests that appear to come from a manager
Shipping delay phishing: “Your order is delayed: update your address to avoid return”
Payment confirmation phishing: Fake receipts for purchases you did not make, designed to create alarm
Charitable giving phishing: Fake year-end donation requests from impersonated nonprofits. Check a charity with the BBB Wise Giving Alliance, a standards-based charity evaluator, before donating, and give through the charity’s own website.
E-card phishing: Malicious e-greeting cards with embedded links or malware

Year-Round: Event-Driven Phishing

Attackers also exploit current events:

Natural disasters: Fake donation sites and fake disaster-assistance applications
Health emergencies: Fake government health notifications and treatment offers
Major data breaches: “Your account may have been affected: verify your information”
Elections: Fake voter registration sites, donation portals, and political messages
Major sporting and entertainment events: Fake tickets, streaming links, and merchandise sites

How to Defend Against Seasonal Phishing

For Individuals

Bookmark official sites: Reach your bank, IRS.gov, shipping accounts, and retailers from bookmarks, not email or text links
Verify delivery notifications in the carrier’s official app or website; a text with a link that claims to be from USPS is a red flag
Use a credit card for online shopping. Under Regulation Z, liability for unauthorized credit card use is capped at $50. Debit card protection under Regulation E depends on speed: report a lost or stolen card within two business days to keep liability to $50 at most, or it can rise to $500, and unauthorized transfers not reported within 60 days of the statement can leave you liable for later losses.
Enable purchase alerts on financial accounts for immediate notice of unauthorized charges
Apply the five-point check to every seasonal message: verify the sender, inspect URLs, question urgency, analyze attachments, and validate requests
Use a password manager: it won’t autofill your password on a lookalike domain, which is a useful warning sign
Monitor accounts closely during busy periods

For Organizations

Before each peak:

Send seasonal security advisories to employees before tax season, open enrollment, and the holidays
Run phishing simulations using seasonal lures a few weeks before each peak
Update email filtering rules for seasonal patterns such as delivery, invoice, and benefits lures
Reinforce payment verification procedures before year-end, including a rule that no one buys gift cards on an emailed or texted request

During peak periods:

Watch gateway reports for new lure themes and adjust rules
Enable enhanced browser security settings
Remind employees to report suspicious messages, especially delivery, payment, and benefits notifications
Share real examples of current campaigns, with links removed

For customer-facing organizations:

Tell customers how you do and do not contact them
Publish a “how to verify our communications” page
Alert customers to known phishing campaigns impersonating your brand
Monitor for lookalike domains registered ahead of your busy season

Reporting Seasonal Phishing

Scam Type	Report To
IRS-impersonation email	[email protected] (“IRS” or “Treasury” in the subject)
IRS-impersonation text	Forward to 7726 (SPAM) and send details to [email protected] with “Text” in the subject
IRS-impersonation call	TIGTA, 800-366-4484
USPS-themed text or email	[email protected], and forward texts to 7726
Other delivery scams	The impersonated carrier’s official fraud page, plus IC3 if you lost money
Charity and shopping scams	ReportFraud.ftc.gov, plus your state attorney general for charities
Any phishing email	[email protected]
Financial loss	Your bank or card issuer, then FBI IC3 immediately

Key Takeaways

Seasonal events change the disguise, not the danger: APWG counted fewer phishing attacks in Q4 2025 than in Q3, but holiday-themed lures still appeared
Tax season, open enrollment (October 15 to January 15 across Medicare and the Marketplace), and holiday shopping each bring predictable lures
The IRS never emails or texts without permission, and USPS delivery texts never contain links
Pay with credit cards online: federal rules cap unauthorized-use liability at $50
Organizations should run seasonal simulations and update filtering before each peak
Event-driven phishing exploits current crises, so stay alert year-round

For the complete phishing defense framework, see our phishing recognition and reporting guide.

Sources

This content is for educational purposes only. Report suspected phishing to ic3.gov, the impersonated organization, and your IT security team.