How scammers (almost) stole Christmas