How do you protect your family from holiday scams? Slow down and go direct. Don't tap links in surprise delivery texts, give only to charities you've researched, and never pay anyone who insists on a gift card, wire transfer or cryptocurrency. Then lock down the basics: long, unique passwords, multifactor authentication on your important accounts, phone settings that share less, and a home that still looks lived in while you travel. Here's each step, with the sources behind it.
This article is general safety and consumer information, not legal or financial advice. If you're in danger, call 911.
Step 1: Treat Surprise Delivery Texts as Bait
The holidays mean packages, and scammers know it. The FTC warns about texts and emails claiming you missed a delivery, or that a package can't arrive until you update your address. Some add pressure: respond right away or the package goes back to the sender. The link is the trap. It can expose your passwords, lead to identity theft or install malware (FTC: Phishing Messages This Holiday Season).
The fix: don't tap, go direct.
- Don't click links in messages about a delivery you weren't expecting.
- Contact the carrier using a phone number or website you know is real.
- Check your order status where you bought the item.
One detail worth remembering: the U.S. Postal Inspection Service says USPS won't text or email you about a package unless you first requested tracking with a tracking number, and those messages won't contain a link. Expecting a parcel? Go to USPS.com yourself (USPIS: Smishing).
Got one? Forward it to 7726 (it spells SPAM), which helps your wireless provider spot and block similar texts. Use your messaging app's "report junk" option and file a report at ReportFraud.ftc.gov (FTC: Spam Text Messages). If you already tapped the link, the Postal Inspection Service advises notifying your bank or card company.
Step 2: Give Generously, but Verify First
Year-end giving should reach a real charity. The FTC's advice (FTC: Donating Safely):
- Research first. Check ratings from groups like the BBB Wise Giving Alliance or CharityWatch.
- Don't be rushed. Don't let anyone rush you into making a donation.
- Check the name. Scam names can closely mimic real charities.
- Pay by credit card or check, and keep records of what you give.
The payment method is often the giveaway. The FTC says never pay someone who insists you can only pay with cryptocurrency, a gift card or a wire transfer (FTC: How to Avoid a Scam). That rule covers far more than charities.
Step 3: Know What Real FEMA Staff Look Like
If a winter storm or other disaster hits your area, watch for people pretending to be from FEMA. FEMA's guidance (FEMA: Be Alert to Fraud After a Disaster):
- FEMA responders and housing inspectors carry official identification badges with photo IDs.
- FEMA and SBA never charge for disaster assistance, inspections or help filling out an application.
- Don't believe anyone who promises a disaster grant in exchange for a payment.
- FEMA inspectors are never authorized to collect your financial information.
Thieves sometimes apply for aid using stolen names, addresses and Social Security numbers. If an inspector shows up and you never applied, say so, and they can stop the application. If you get a FEMA letter you didn't ask for, report it to the FEMA Fraud Branch. If you've been scammed, report it to your local police or sheriff, and report charity scams to the FTC and your state charity regulator.
Step 4: Lock the Digital Door
Scam links often go after your passwords, so your accounts deserve the same care as your front door. CISA's Secure Our World program keeps the basics short (CISA: Use Strong Passwords):
- Long: at least 16 characters.
- Random: a string of mixed-case letters, numbers and symbols, or a passphrase of four to seven unrelated words.
- Unique: a different password for every account, so one leak doesn't unlock the rest.
CISA recommends a password manager to create, store and fill in those passwords, so you only need to remember one strong passphrase. Some are free, including the one built into your web browser, and many warn you about weak or reused passwords.
Next, turn on multifactor authentication (MFA). It adds a second step, so a stolen password alone isn't enough. Start with email, banking and social media, then every account that offers it. Look under the account's security settings, where it may be called two-factor or two-step authentication (CISA: Turn On MFA).
Not all MFA is equal, but CISA is clear that any MFA is better than none (CISA: More Than a Password):
| Type | How it holds up |
| Security key or passkey (FIDO) | Phishing-resistant; the strongest form |
| Authenticator app | Better than text codes, but codes can still be phished |
| Text message codes | Weakest of the three, still better than no MFA |
Finally, stop snoozing updates; many fix security flaws. Turn on automatic updates and keep everything current, especially your web browser (CISA: Update Software).
Step 5: Make Your Phone Share Less
Your phone already has free controls for what it shares. Start with location. Apps must ask before using it, and you can change your answer any time: on iPhone, go to Settings > Privacy & Security > Location Services (Apple Support); on Android, open App location permissions (Android Help). If an app needs your location, allow it only while you're using the app, and turn off precise location where an approximate one will do.
Then review other permissions, like contacts and photos, and consider turning off any an app doesn't need (FTC: How Apps Collect Your Information). Delete apps you don't use and keep the rest updated.
Both iPhone and Android (version 6 and up) can alert you if an unknown Bluetooth tracker is moving with you. On iPhone, that means Tracking Notifications on, Bluetooth on and Airplane Mode off (Apple Support). If you get an alert and feel unsafe, Google advises going to a safe public place and contacting law enforcement (Android Help).
Step 6: Keep Your Home From Looking Empty
Traveling for the holidays? Your goal is a house that looks lived in. Before you leave:
- Lock every way in: doors, windows, pet doors and garage doors. Lock sliding glass doors and set a dowel in the track (Alcoa, TN Police).
- Keep the spare key with a trusted neighbor, not under the mat (National Crime Prevention Council).
- Put lights on timers that vary when they turn on and off, and keep valuables out of view from outside.
- Pause the mail. An overflowing mailbox signals an empty house (Dixon, CA Police). USPS Hold Mail keeps it at your Post Office for 3 to 30 days, and you can request it up to 30 days ahead (USPS Hold Mail).
- Tell a trusted neighbor you'll be away. Some police departments will check on homes while owners are away, so call yours and ask.
And hold the vacation photos. The U.S. Army Criminal Investigation Command advises against checking in at airports or your destination, and suggests posting after you're home (Army CID). CISA adds that location tags can show where you are, and where you aren't, so turn off geotagging and keep your address and travel plans private (CISA: Social Media Tip Sheet).
Frequently Asked Questions
Does USPS send texts about missed deliveries?
Only if you asked for tracking first with a tracking number, and the U.S. Postal Inspection Service says those texts won't contain a link. A surprise USPS text with a link is a red flag. Track your package at USPS.com instead.
What should I do if I clicked a link in a scam text?
Tell your bank or card company, as the Postal Inspection Service advises. Then report the message to the FTC at ReportFraud.ftc.gov and forward the text to 7726.
Does FEMA charge to inspect my home after a disaster?
No. FEMA and SBA never charge for disaster assistance, inspections or help applying, and FEMA inspectors never collect your financial information. Real inspectors carry official photo ID badges.
Gear for the Physical Side of Security
Most of this guide costs nothing but a few minutes in your settings. For the physical side, a safe or lock box keeps documents and valuables out of sight, and good lighting helps when you get home after dark. Browse our safes, vaults and lock boxes, safety and security gear and lights, and read Pillar 6: Security for the bigger picture.
