Criminals pay close attention to calendars. They know that during holiday weeks, offices run with reduced staff, approvers are out, and the people covering for them may be less familiar with normal procedures. A request that would raise eyebrows on an ordinary Tuesday can slip through when the usual controller is on vacation and a busy project manager is trying to clear their inbox before heading home.
The FBI's Internet Crime Complaint Center has long warned businesses about business email compromise, in which criminals impersonate executives or vendors to redirect payments. Holiday periods, month-end closings and pay application deadlines are all moments when urgency feels natural, and urgency is the attacker's best tool.
Common holiday-season scenarios
Consider some patterns, presented here as examples rather than specific incidents.
- A message that appears to come from the owner, sent while they are traveling, asks accounting to process an urgent wire and says they cannot take calls.
- A vendor "updates" their bank details by email, citing a year-end change in banking arrangements.
- A fake invoice arrives from a supplier you actually use, timed to be paid before year-end.
- A message asks an assistant to purchase gift cards for employees or clients and send the codes.
- A payroll change request appears to come from an employee, asking to redirect direct deposit to a new account.
Each exploits the same weaknesses: reduced oversight, an appeal to authority, and time pressure.
Build coverage into your time-off planning
Name backups for every approver
For each person who approves payments, designate and train a backup. Make sure the backup knows the procedures and has the authority to say no.
Review approval limits
Consider temporarily lowering thresholds that require dual approval during holiday weeks, or require that any non-routine payment wait until a full team is back.
Do not rely on one email channel
Executives who travel should agree on how urgent requests will be confirmed, such as a call to a known number. A request that claims "I can't talk" is a red flag, not a reason to skip verification.
Verification rules that do not bend
Write these where the covering staff can see them.
- Never change payment instructions based on email alone. Call a known number.
- Never process an unusual wire request without a second person confirming it by phone.
- Never buy gift cards or send codes on an emailed request.
- Never redirect payroll deposits without verifying with the employee in person or by a known phone number.
- If a request cites secrecy or urgency, treat that as a reason to slow down.
Technical safeguards to check before the break
- Multi-factor authentication on all email and banking accounts.
- Alerts from your bank for wires, ACH changes and new payees.
- Email rules. Check mailboxes of executives and accounting staff for unexpected forwarding or hidden rules.
- External sender banners that make outside email visible.
- Monitoring. Confirm your security provider has current contact information and escalation paths for the holiday period.
Prepare your people
Send a short note before holidays. Remind staff of the verification rules, who to contact, and that no one will be penalized for delaying a payment to confirm it. Make sure the people covering know that it is acceptable to wait for the controller to return.
If something goes wrong on a holiday
Speed matters most. Know in advance who to call at your bank, including after-hours fraud numbers, and have them in a printed or offline list. Contact the bank immediately to request a recall, then notify your IT provider and file a report with IC3. Preserve the emails and details.
A small investment
Fifteen minutes of planning before the break can prevent a loss that takes months to unwind. Coverage plans, clear rules and bank alerts are inexpensive compared with a single diverted payment.
Ironfield Cyber helps contractors and energy companies write payment verification procedures, strengthen email protection and prepare staff for high-risk periods. If you would like a quick review of your approval and verification process, we are happy to help.