Summer is when many businesses run on a skeleton crew. Decision-makers are on leave, approvals get delegated, and out-of-office messages announce exactly who is away and for how long. Attackers know this, and they plan for it.
None of this means you should cancel anyone’s holiday. It means planning for the gaps, so a quieter office doesn’t become an easier target.
Why attackers like the summer months
Most successful attacks rely on timing and pressure rather than technical brilliance. A fake invoice is more likely to be paid when the person who normally checks it is on a beach. A request to “urgently change bank details” lands better when the finance lead can’t be reached to confirm it.
Monitoring can also slip. If alerts go to one person’s inbox and that person is away, suspicious activity can sit unnoticed for days. That delay is often what turns a minor incident into a serious one.
Plan cover before people leave
Holiday cover is usually planned around workload. It should also be planned around security responsibilities.
- Name a deputy for every approval. Payments, access requests and supplier changes should all have a clearly named stand-in, so nobody improvises.
- Keep the verification rules the same. If bank detail changes normally need a call-back to a known number, that rule doesn’t relax because someone is covering.
- Check who receives security alerts. Make sure alerts reach a monitored shared mailbox or a 24/7 service, not one person’s inbox.
- Review temporary access. If cover staff need extra permissions, give them for a set period and remove them on return.
Make out-of-office messages less useful to attackers
Auto-replies are a gift for anyone researching a target. They confirm an email address is live, reveal who is away and often name the person to contact instead. That is everything an attacker needs to impersonate either of them.
Keep auto-replies short. “I’m currently out of the office and will reply on my return” is enough for external contacts. Save the detail about who is covering for internal messages, where you can control who sees it.
Brief the team on what to expect
A short reminder before the holiday season goes a long way. Remind staff that:
- Urgent payment or data requests “from the boss” while they’re on leave deserve extra suspicion.
- Holiday-themed scams, such as fake booking confirmations, travel refunds and parcel notices, are common at this time of year.
- Reporting something odd is always the right call, even if it turns out to be harmless.
Don’t forget the devices travelling with your people
Laptops and phones go on holiday too, whether they should or not. Encourage staff to keep devices updated before they leave, avoid untrusted public Wi-Fi for work, and report a lost or stolen device immediately so access can be revoked.
A simple pre-holiday checklist for managers
Before anyone on your team heads off, run through a few quick questions together. It takes ten minutes and removes most of the guesswork.
- Who approves payments, purchase orders and supplier changes while I’m away, and do they have the right access?
- Who should external contacts speak to, and is that written down somewhere the team can find it?
- Are any systems, projects or contracts likely to need a decision while I’m out?
- Do I have any shared logins or access that someone else will need? If so, how will they get it safely, without sharing a password?
- Is my laptop up to date, and will it come with me or stay locked away?
It’s also worth agreeing a simple rule for contact while people are away. If something genuinely needs a holiday-maker’s input, the team should reach them by phone on a known number, not by replying to an email that claims to be from them. That single habit closes the door on most impersonation attempts.
When people return, ask them to check for anything unusual: unexpected sign-in alerts, mailbox rules they didn’t create, or messages sent in their name. Spotting problems in the first hour back is far better than finding them weeks later.
Build habits that last beyond summer
The best protection is a team that recognises a suspicious request at any time of year. Regular, short training sessions build those instincts far more effectively than a single annual reminder.
CyberQ’s Cyber Awareness Training helps your people spot and report threats with confidence, whether the office is full or half-empty. Get in touch to find out how we can help your team stay alert this summer.
