December brings more bills to pay and fewer people at their desks to check them.
In my years at the bank, the weeks before the holidays always felt busier on the fraud side. Criminals read the calendar the same way retailers do. In December, accounts payable is working through a pile of year-end invoices. People are taking a day off here and there. The owner is out at client lunches. Everyone wants things paid before the break so nothing drags into January. That's a lot of money moving, quickly, with fewer people watching.
There are three things I'd ask any small business owner to get ahead of before the season starts.
The invoice that looks like a renewal
Fake invoices are an old trick, and they still work because December is full of real ones. Software renewals, domain names, directory listings, maintenance contracts, association dues. A bill arrives that looks about right, for an amount that doesn't alarm anyone, from a name that sounds like something you already use. Someone pays it to keep the pile moving.
The ACFE's Occupational Fraud 2026: A Report to the Nations found billing schemes in 28% of the cases at organizations with fewer than 100 employees. Those cases involve insiders, but the outside version slips through the same gap. Nobody compares the bill to something the company actually ordered.
The fix is a rule. No invoice gets paid unless someone can say what we bought and point to it, whether that's a contract, a purchase order or a renewal they recognize. If nobody can, it waits until January. Real vendors will call. Be especially careful with any invoice from a company that isn't already in your vendor list, which is one more reason to keep a close eye on who can add a vendor.
The gift card text from the boss
This one comes as a text or an email that looks like it's from the owner. "Are you at your desk? I need a quick favor. I want to send gift cards to a few clients before Friday. Can you pick some up and send me the codes? I'll pay you back." It's friendly and a little rushed, and it arrives in the one season when buying gift cards for clients sounds perfectly normal.
Here's a composite of how it tends to go. A man I'll call Marcus managed the office at a small architecture firm. The owner, a woman I'll call Helen, was out on a site visit most of one December afternoon. Marcus got a text that appeared to be from her, asking for six hundred dollars in gift cards for clients. He bought them on his own card at the drugstore on the corner, scratched off the backs and texted photos of the codes. Then came a second request for more. That one made him uneasy, so he called Helen's cell. She had no idea what he was talking about. The first six hundred dollars was already gone.
Marcus did what he thought his boss wanted. The firm had never told him otherwise. The FTC's advice on this is blunt: gift cards are for gifts, not payments, and once someone has the numbers off the back, the money is usually gone.
So say it out loud before December, to everyone who might get that text. You will never ask anyone to buy gift cards by text or email. Client gifts go through the normal purchasing process with a receipt. Any request for money that seems to come from you gets a call back on your regular number, the same habit I wrote about in Ten minutes is not too long to wait.
The check that got washed
If you still mail paper checks, December is when it matters most. Mail volume is high, envelopes sit longer, and a stolen check can be soaked to remove the ink, rewritten to a new payee or a bigger amount, and deposited. The U.S. Postal Inspection Service says postal inspectors recover more than $1 billion in counterfeit checks and money orders every year.
A few habits help a great deal.
Mail checks inside the post office or hand them to your carrier. Don't leave them overnight in a mailbox or an outgoing tray in the lobby.
Write checks in indelible black ink, and fill the payee and amount lines all the way so there's no room to add anything.
Ask your bank about Positive Pay. You send the bank a list of the checks you wrote, and anything that doesn't match gets held until you decide whether to pay it. Of everything here, this is the control I'd most like to see at every company that writes checks.
Move regular vendors to ACH where you can, and confirm their bank details with a phone call to a number you already have.
In December, reconcile weekly. Look at the images of cleared checks, front and back, and make sure the payee and the endorsement match who you meant to pay.
When a vendor tells you a check never arrived, believe them and look into it the same day.
None of these take more than a few minutes once they're set up, and the setup is easier now than in the middle of the rush.
Who in your office is most likely to get a text from you this December asking for a favor, and do they know what to do with it?
Want to know how your controls hold up? Start a conversation.