Scammers don’t take time out for the holidays, and if you don’t know what to expect you can be their next victim. One of the oldest Christmas-themed scams is the alleged letter from Santa.

In this ruse, scammers set up bogus websites for parents to allegedly order legitimate-looking letters from Santa for their children. All victims need to do is share some details about their child along with the victims’ credit card info, and the letter is (supposedly) as good as mailed. Some sites will even offer to send the letter at no cost, so long as you share some details about your child.

Unfortunately, anyone who follows the instructions on the site is prey to the scam. They’ll never see that letter or the money they paid to have it created and delivered. Worse, the scammers now have their child’s information and the victim’s credit card details, which can lead to identity theft. Sometimes, crooks will go after the children’s credit, which will likely go unchecked for years. When the children are grown, they may find that their credit score has been destroyed by these scammers over the years, all without their knowledge.

There are legitimate letter-from-Santa sites, but the bogus ones can be difficult to spot. Look for the following red flags when searching for this kind of service:

• The scammer reaches out to you repeatedly. If a company doesn’t stop sending you emails or alerts about its services, you may be dealing with a scammer.
• The site is not secure. As always, check for the lock icon and the ‘s’ after the ‘http’ in the URL; both indicate a site is secure.
• You need to answer too many questions. There’s no need for a letter-from-Santa service to know your child’s exact date of birth, and certainly not their Social Security number.
• You can’t find positive online reviews about the company. If an online search for the company turns up empty, and of course if it turns up any reports of past scams, opt-out.

If you’ve recognized a company as a scam, be sure not to click on any links embedded in its emails. Flag their emails as spam, and delete every email, message and alert it sends.