top of page
Search

Festive-Season Phishing & AI Deepfakes: How to Stay Safe in 2026

  • SEMNET TEAM
  • 7 days ago
  • 8 min read

Holiday cheer can hide high-tech scams. Picture this: you are juggling last‑minute gifts, a shipping text pings your phone, a charity video autoplays in your feed, and then your “boss” calls asking for an urgent wire before the bank closes. In 2026, these lures are supercharged by AI. Deepfake voices sound like people you know. AI chatbots mirror brand tone in DMs. Fake promo videos look studio‑grade. This guide shows simple routines that help you shop and work safely without losing the season’s joy.


What is phishing today?


Phishing is any message that tricks you into clicking, paying, or giving up secrets. It now spans:


  • Email phishing

  • SMS texting or chat app smishing

  • Voice calls or voicemail vishing

  • Social DM and in‑app support scams


Why it is tougher in 2026:


  • AI lowers the cost of creating perfect grammar, logos, voices, and video.

  • AI increases scale. One actor can send and pivot messages across languages and channels in minutes.

  • AI boosts believability. Models can mimic brand tone and people you know, then adjust in real time when you push back.


Data points to watch this season:


  • U.S. losses reported to the FBI’s Internet Crime Complaint Center hit 16.6 billion dollars for 2024. Business email compromise remained one of the most costly categories. The 2025 AFP survey found 79 percent of organizations were targeted by payments fraud in 2024, with BEC the top avenue at 63 percent. (nacmnc.org)

  • Deepfake voice fraud in contact centers surged, with a 1,300 percent rise noted in 2024 and continued growth projected for 2025. (prnewswire.com)

  • The 2025 Verizon DBIR highlights that social engineering remains a persistent breach pattern, with the human element still prominent and third‑party involvement doubling year over year. (verizon.com)


Why festive season risk spikes


  • Urgency and volume. Deliveries, returns, gift cards, flash deals, donation drives, and travel changes make us act fast and miss subtle red flags. CISA and FTC both warn that holiday shopping brings more phishing and imposter offers. (cisa.gov)

  • Travel and out‑of‑office. Approvals stall and people rely on text or phone, which scammers exploit.

  • Seasonal hiring. New or temporary staff may not know payment verification routines.

  • Charity and year‑end giving. Donation lures evolve with convincing stories, videos, and cloned voices.

  • Higher transaction value. Fraud attempts concentrate where attention is lowest and dollar amounts are highest.


The AI‑enabled threat playbook in 2026


Below are common patterns we see this season. Samples are generic and redacted.


1) Deepfake voice vishing to Finance


  • Tactic: An urgent call or voicemail that sounds like your CFO, using data from LinkedIn and earnings calls, asks for a vendor prepayment or routing change.

  • Redacted script: “Hi, it’s [Name]. I am boarding. Approve the vendor advance today. Use account ending [xxx]. Call me here if needed.”

  • Risk: Realistic voice plus travel urgency can bypass email controls. FBI has warned about AI voice and text impersonation of senior officials, and enterprises report costly CEO deepfake incidents. (fbi.gov)


2) AI chatbots in social DMs


  • Tactic: Accounts that look official reply instantly to your support DM, matching brand tone and linking to a “refund portal.”

  • Redacted message: “We are sorry about the delay. Verify your order at support‑portal[.]shop‑help‑status[.]com.”


3) Deepfake videos or images for promos and giveaways


  • Tactic: Realistic short videos of a known creator or local store owner launch a “holiday giveaway” that requires a small “verification payment.”

  • Red flags: New account, off‑platform payment, and comment bots hyping fake winners.


4) QRishing on receipts, meters, and posters


  • Tactic: QR stickers over real codes on parking meters, store windows, or mailed “brushing” packages push you to fake payment or app downloads. FBI issued a 2025 PSA about unsolicited packages with QR codes. (fbi.gov)


5) Lookalike domains and homoglyphs


  • Tactic: Domains like shop‑hollday[.]com or payrnents‑portal[.]io with swapped letters. The link preview and spoofed display name hide the trick.


6) Multilingual phishing at scale


  • Tactic: AI translates lures into your preferred language and localizes holidays, delivery vendors, and banks.


7) Synthetic identities in customer support calls


  • Tactic: Fraudsters blend leaked data with AI‑generated IDs, then call support to reset accounts or redirect store credits.


8) Toll and delivery smishing storms


  • Tactic: Mass texts about unpaid tolls, delivery reschedules, or return labels peak during the holidays. FTC and major outlets flagged a 2025 surge in fake shopping and toll texts. (consumer.ftc.gov)


Red flags and quick checks (cheat sheet)


Verify voices and calls


  • Agree on a safeword inside your team or family. Use it before discussing money.

  • Do not approve payment or change bank details from an inbound call. Hang up and call back using a number from your directory or the official site.


Email authentication cues


  • For businesses: enforce DMARC alignment plus DKIM and SPF. In Wix, you can add SPF and DKIM records and consult deliverability guidance that references DMARC for high‑volume senders. (support.wix.com)

  • View headers in your mail app to confirm the sending domain matches the visible From. If it fails DMARC or has no DKIM, treat it as suspicious.


Link and domain checks


  • Hover on desktop or long‑press on mobile to preview the URL. Watch for subtle letter swaps.

  • For critical payments, copy the URL, paste into a plain text editor, and inspect carefully. If in doubt, go to the site by typing the root domain.


Payment change verification


  • Use a written policy. Require two‑person approval and an out‑of‑band callback to a verified number whenever routing or beneficiary details change.


Delivery and charity verification


  • Track orders only through the retailer’s site or app. Do not trust links sent by text.

  • Verify charities on IRS Tax Exempt Organization Search or Charity Navigator. Donate through the charity’s official site.


QR code safety


  • Do not scan codes on unsolicited packages, posters, or stickers. If you must scan, verify the short preview link and navigate manually instead when payment is involved. FBI warns of QR codes used in brushing scams. (fbi.gov)


Social giveaway sanity checks


  • No brand will ask you to pay a “verification fee” to claim a prize. Check the account age, follower mix, and cross‑post history.


Step‑by‑step response plan if you clicked, downloaded, or paid


1) Pause and isolate

  • Disconnect from Wi‑Fi. Put the device in airplane mode. Do not power off if malware forensics are needed.


2) Secure accounts

  • Change passwords on affected accounts. Revoke active sessions and tokens. Turn on MFA or passkeys where available. FIDO reports passkey awareness and use surged in 2025, and Microsoft made new accounts passwordless by default. (fidoalliance.org)


3) Contact your bank or processor

  • Ask for a recall or chargeback if wired or carded. For ACH or wire, speed matters.


4) Report

  • FTC: reportfraud.ftc.gov

  • FBI IC3: ic3.gov

  • CISA: cisa.gov/report

  • Your state attorney general’s office


5) Notify IT or security

  • Tell your admin what you clicked, when, on which device, and any credentials entered.


6) Document

  • Keep screenshots, emails, headers, phone numbers, QR images, and timelines.


7) Communicate carefully

  • If you run a business, inform affected customers with clear facts, next steps, and a verified support number. Avoid speculation. Provide status updates on your Wix site or blog.


Business safeguards for the season


Authentication and access


  • Enforce multi‑factor authentication and passkeys for staff and admins.

  • Restrict access by role. Rotate API keys and make sure session lifetimes are sensible.


Finance controls


  • Two‑person approvals for invoices and vendor changes.

  • Out‑of‑band callbacks from your official directory. No approvals by text or chat alone.


Hard blocks and monitoring


  • Block lookalike domains and VIP impersonation in email security.

  • Turn on DMARC with p=reject once you are confident in alignment. Keep DKIM signing and SPF hygiene. AFP notes wire transfers were the most targeted by BEC in 2024 and BEC stayed the top fraud vector. (afponline.org)


Vendor and customer verification


  • Maintain an allowlist of trusted suppliers and a callback sheet with verified numbers.

  • Require tax ID plus bank letter on letterhead for any payment detail changes.


Preparedness drills


  • Run a 15‑minute red team drill weekly during peak season: one fake invoice, one fake delivery text, one deepfake call test.


Coverage and escalation


  • Publish an escalation tree with backups for holidays and travel. Use a central hotline number on your site footer.


Out‑of‑office templates


  • Avoid naming decision‑makers or travel dates. Direct vendors to a central verified number.


Family and elderly support


  • Share a home safeword. Pre‑save official numbers for banks, airlines, and utilities.


Fast wins for individuals


  • Use a password manager and enable passkeys where offered.

  • Turn on bank or card transaction alerts for every charge.

  • Auto‑update your phone, browser, and mail app. CISA stresses regular updates and phishing awareness for everyone. (cisa.gov)

  • Enable carrier call protection and silence unknown callers.

  • Freeze your credit if you do not plan new credit lines soon.

  • Save official support numbers before you travel.


Myth vs. fact


  • Myth: “I can spot bad grammar.” Fact: AI writes clean copy and mimics brand tone.

  • Myth: “Phone calls are safer than emails.” Fact: Deepfake vishing is rising and can sound exactly like your colleagues. (prnewswire.com)

  • Myth: “QR codes are fine if they scan.” Fact: QRishing is surging via stickers, receipts, and packages. Verify before you scan. (fbi.gov)

  • Myth: “Only big companies are targeted.” Fact: SMBs see persistent social engineering. DBIR and AFP trends show human and third‑party exposures remain high. (verizon.com)


10‑point consumer checklist


1) Pause before you tap, scan, or pay.

2) Verify delivery texts in the retailer app, not via links.

3) Use credit cards over debit for stronger dispute rights.

4) Turn on passkeys and account alerts.

5) Do not scan QR codes from stickers, random flyers, or unsolicited packages. (fbi.gov)

6) Call back using numbers you saved, not those in the message.

7) Update your phone and mail app.

8) Use a password manager for unique passwords.

9) Freeze credit if you spot identity misuse.

10) Report scams to FTC and IC3 to help others.


12‑point SMB checklist for peak season


1) Two‑person approvals for payments and bank changes.

2) Out‑of‑band callbacks on a printed vendor sheet.

3) DMARC p=reject after alignment, DKIM signing, SPF cleanup. (support.wix.com)

4) VIP impersonation filtering and domain lookalike blocking.

5) MFA and passkeys for all admins and finance roles. (fidoalliance.org)

6) Role‑based access to finance and storefront systems.

7) Weekly 15‑minute phishing and vishing drills.

8) QR code policy: no codes on invoices, posters, or receipts without verification. (fbi.gov)

9) Central hotline for vendors during staff holidays.

10) Incident playbooks for refund fraud, BEC, and account takeover.

11) Backup and test restores for websites and POS.

12) Publish a clean out‑of‑office template that routes to a verified number.


Click‑to‑copy: Holiday Payment Verification Policy


Holiday Payment Verification Policy

1) No payment or bank‑detail change is approved from email, text, chat, or inbound call.

2) Require two approvers for any new vendor or account change.

3) Perform a mandatory callback using our directory or contract, never the message.

4) If rushed or pressured, the answer is no until verified.

5) Log every verification in the ticket system.



Short glossary


  • Deepfake: AI‑generated media that convincingly imitates a real person’s voice or appearance.

  • Vishing: Voice phishing using calls or voicemail to steal money or data.

  • QRishing or quishing: Phishing delivered via QR codes that redirect to malicious sites.

  • BEC: Business email compromise that manipulates people or processes to divert payments.

  • DMARC, DKIM, SPF: Email authentication standards that prevent spoofing and protect recipients.


Trusted guidance and reporting links



References for figures and trends cited above: CISA holiday guidance, FTC holiday advisory, FBI PSAs on QR and impersonation, 2025 Verizon DBIR, AFP 2025 Payments Fraud Survey, and Pindrop 2025 Voice Intelligence Report. (cisa.gov)


Conclusion and next steps


AI deepfakes and holiday phishing thrive on hurry, habit, and trust. Your best defense is a calm, repeatable routine: stop, verify through a known channel, and report. Use passkeys and MFA, lock down payments with callbacks and two‑person checks, and keep QR scanning on a short leash. This approach lowers risk while you enjoy the season.


Recent Posts

See All
bottom of page