Fraudsters study calendars as carefully as they study invoices. Holiday weeks, long weekends, and vacation seasons leave finance teams thin, approvers unreachable, and normal verification habits strained. A payment request that would have drawn a call on a regular Tuesday slips through on the Wednesday before a holiday.
The FBI's Internet Crime Complaint Center has published guidance on business email compromise for years, and the pattern is consistent: criminals rely on urgency, authority, and distraction. Holiday weeks supply all three. This post offers a practical plan for keeping controls intact when the office is half empty.
Why holidays raise the risk
- Fewer eyes. The second approver is on vacation, so one person handles everything.
- Delegation under pressure. Someone unfamiliar with the process fills in.
- Urgency is believable. "We need this before the holiday" sounds reasonable.
- Executives are traveling. A message that appears to come from the owner asking for a favor is harder to check.
- Vendors are also out. Callbacks go to voicemail, which tempts people to skip verification.
- Year-end pressure. Vendors and customers push to settle accounts and invoices.
Rule one: verification does not take a holiday
Write it into your policy and say it out loud to the team: banking changes and unusual payment requests are not processed until verified by phone with a known contact. If the contact is out, the payment waits. A late payment can almost always be explained. A diverted payment is hard to recover.
Rule two: plan coverage before people leave
Two weeks before a holiday period, review:
- Who is covering each role, including payables, payroll, and wire approval.
- Whether backups are trained. Provide a one-page checklist covering vendor verification and approval limits.
- How approvers can be reached, and what the limits are for emergency payments.
- What payments are scheduled, so unusual ones stand out.
Rule three: lower or freeze risky actions
Consider a temporary freeze on these during the holiday window, unless a documented exception is approved:
- Changes to vendor banking details.
- Changes to employee direct deposit.
- New vendors added and paid in the same week.
- Wire transfers to first-time recipients.
A freeze reduces exposure and gives you a legitimate answer to urgent requests.
Rule four: have a firm approach to executive requests
If a message from the owner arrives asking for gift cards, a wire, or a change in payroll, confirm by phone or in person regardless of how convincing it looks. Tell the owner ahead of time that this is expected, and that they should answer calls from the team about such requests. Make it clear that no one will be criticized for checking.
Technical safeguards to review before the break
- Multi-factor authentication on all email accounts, with no exceptions for executives.
- Alerts for new inbox rules and unusual sign-ins, directed to someone who will actually be watching.
- Email banners marking external senders.
- Out-of-office messages that avoid detailing travel plans and who is covering for whom, since attackers read these.
- Admin accounts secured, with limited use during the break.
- Contact list for IT, your bank, and your insurer that is accessible to the people on duty.
Know who to call
Print a short sheet for whoever is on duty:
- Your bank's fraud and wire recall number.
- Your IT or security provider's emergency number.
- Your cyber insurer's claims hotline.
- The owner's or CFO's cell phone.
If a bad payment goes out, speed matters. Contact the bank at once, preserve emails, reset affected passwords, and file a report with the IC3.
Keep it humane
Calling people during a holiday to verify a payment is irritating. Make it easier: give each approver a way to confirm quickly, such as a short text exchange through a known number or a secure messaging app that does not rely on email. The goal is a procedure people will actually follow.
After the holiday
When everyone returns, review the payments made during the break. Look for new vendors, changed banking details, and payments outside the normal pattern. Catching a problem a few days later is better than discovering it at month-end.
Preparing with Ironfield Cyber
Ironfield Cyber helps contractors and energy companies tighten email security and payment verification, and can put together a holiday coverage checklist for your finance team. A short review before the next holiday week is time well spent.