The last stretch of the year has a particular feel in most offices. Half the team is out. The other half is covering two jobs. Everybody is trying to close things out before the building goes quiet, and nobody wants to be the person who slows anything down.
That mood is the whole point of this post. None of the threats below are new or clever. What makes them work in the fourth quarter is context: fewer people watching, more urgency in the air, and a general willingness to skip the usual checks because it is a busy week and the boss is traveling. Here is what to expect, and a short list to run before the office empties out.
Why Attackers Like a Skeleton Crew
This is not a hunch. The FBI and CISA published a joint advisory on ransomware awareness for holidays and weekends, and the reasoning in it is blunt. Attackers favor those windows because, in the advisory’s words, “network defenders and IT support of victim organizations are at limited capacity for an extended time.” A quiet network gives an intruder more room to move around before anyone notices.
Think of it the way a burglar thinks about a house with the mail piling up. The lock is the same lock it was last week. What changed is how long they get to work on it undisturbed. That advisory recommends that organizations, quoting again, “Continuously and actively monitor for ransomware threats over holidays and weekends,” and that IT security staff be designated as on call during those periods. Both of those are planning decisions, not technology purchases, and they have to be made before the calendar turns.
The Gift Card Request Is Never Real
Every holiday season, some version of this email lands: the owner is stuck in a meeting, needs a batch of gift cards for the team or a client, and can somebody grab them quickly and send the codes? It is short, it is friendly, it is a little urgent, and it is always fake.
The FTC says it about as plainly as an agency can: “No real business or government agency will ever tell you to buy a gift card to pay them.” The FBI lists executives requesting gift cards among the common business email compromise scenarios it sees. So the rule for your staff needs no judgment at all, which is exactly what makes it good: nobody at this company will ever ask you to buy gift cards by email or text. If the request exists, it is a scam, no matter whose name is on it.
If somebody does get caught, act the same day. The FTC advises contacting the gift card company right away, asking whether the funds can be refunded, keeping the card and the store receipt, and reporting the incident at its fraud reporting site. Money has occasionally been recovered when people move fast.
Shipping Notices and the Personal Inbox at Work
Seasonal shipping scams are not aimed at your company. They are aimed at your employees, on your devices, which amounts to the same thing. A text says a package could not be delivered. An email says a small customs fee is due. A notice says the address needs confirming. In a month when everyone genuinely has four packages in transit, the hit rate goes way up.
The tell is always the same, and it is worth teaching once: real delivery notifications do not need your password or a small payment. If a message asks for either, it is a fake. The safe habit is to check tracking in the carrier’s app or on the retailer’s site, never through the link in the message. If you want the longer explanation of why these get through filters in the first place, we covered it in our post on the surge in phishing attacks.
Wire Fraud While Everyone Rushes to Close the Books
Year end is when finance teams are pushing to get invoices paid, vendors settled, and books closed. It is also when a message arrives from a supplier with updated banking details, or a final invoice that needs paying today so it lands in the right period.
The FBI describes exactly this pattern in its material on business email compromise: vendors sending invoices with updated addresses, criminals inserting themselves into billing threads, and requests engineered to feel urgent. Its advice is to “Verify payment and purchase requests in person if possible or by calling the person to make sure it is legitimate,” and when contacted out of the blue, to “Look up the company’s phone number on your own (don’t use the one a potential scammer is providing).”
Written as a policy your bookkeeper can actually follow: banking details never change based on an email. Ever. Any change to where money goes requires a phone call to a number already on file, made by a second person, and a note in the record of who confirmed it and when.
Coverage Planning So Verification Survives the Vacation
Here is where most holiday incidents actually originate, and it is not a technical failure. It is that the person who is supposed to approve something is unreachable, and the process quietly collapses into “just handle it.”
Fix that with names, not intentions:
- Name a backup approver in writing. For every approval that involves money or account access, one named primary and one named backup, both known to the team before anyone leaves.
- Publish the phone tree. Cell numbers for the approvers, held where the finance team can reach them without searching email.
- Keep the out of office message vague. “Out of the office with limited access, please contact Dana” is fine. Detailed travel plans tell an attacker who is gone and for how long.
- Decide who is actually on call for IT. Not assumed. Named, with a number, and with authority to shut something off at 10 p.m. without hunting for permission.
- Give people permission to wait. Say out loud that no legitimate request will ever be ruined by a phone call. If verification cannot happen, the payment waits until it can.
The Short List Before the Office Empties Out
- Confirm backups ran and can be restored. Not that the job reported success. That a file was actually pulled back and opened by a human.
- Patch everything, then verify. Especially anything reachable from the internet: firewall, VPN, remote access.
- Disable accounts for anyone who left. Seasonal help and departures both. An unused account nobody is watching is an ideal way in during a quiet week.
- Check that alerts reach a human. Security alerts routed to an inbox nobody opens until the new year are decorative.
- Send one short reminder to the team. Gift cards, banking changes, delivery texts. Three sentences. Send it before the last week, not during it.
The Bottom Line
Holiday risk is not about new attacks. It is about the same attacks landing when fewer people are watching and everyone feels rushed. The counter is unglamorous and it works: decide in advance who verifies what, name a backup for every approver, make a couple of rules absolute so nobody has to make a judgment call under pressure, and confirm before the office empties that your backups, patches, and alerts are in the shape you assume they are. None of that requires buying anything. It requires doing it in the first week of the quarter instead of the last.
If you would rather have someone else run that checklist, watch the network while your team is out, and be the number your staff can call at 9 p.m. when an email looks wrong, that is what we do. We support small and mid sized businesses throughout Denton County and the surrounding area. Contact us today
Sources:
Comments are closed