The last fortnight of December is, for many organisations, the most dangerous stretch of the year. Inboxes fill with delivery notices for parcels nobody ordered, HR teams get urgent-sounding requests to redirect salaries, and finance staff work at half speed while half the office is on leave. Attackers plan for exactly this. They send messages that land when verification is weakest, because few people want to phone a colleague at nine in the evening on 27 December to ask whether an invoice is real.
Seasonal pressure does not change your legal position. If a phishing email leads to a breach of employee personal data, the clock starts whether the data protection officer is at their desk or on a beach.
The scams that dominate November to January
Most holiday fraud is not technically sophisticated. It works because it mimics something the recipient is already expecting or worrying about.
- Fake delivery and customs notices. A missed-parcel message with a small redelivery fee, timed to the weeks when people genuinely are expecting parcels.
- Payroll diversion. A message that appears to come from an employee asking HR to update their bank details before the December run. The salary lands in someone else's account.
- CEO and supplier invoice fraud. A short, deliberately vague email from a senior name asking for an urgent payment while they are "travelling".
- Fake IT and MFA resets. "Your account will be suspended over the holidays unless you re-verify." These harvest credentials and session tokens.
- Charity and e-card lures. Seasonal goodwill campaigns, often with a familiar sender name and a link that leads to a credential-harvesting page.
- Gift card requests. Small, plausible amounts, sent to junior staff by someone impersonating a manager.
What the law actually asks of you
If you handle personal data, you already have duties that a phishing incident can trigger. Under the EU and UK GDPR, a breach that is likely to result in a risk to people's rights and freedoms must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of you becoming aware of it. Where there is a high risk to individuals, you also have to tell those individuals without undue delay. Employee data counts. Payroll records, bank details, ID documents and health information held by HR are all in scope.
Sector rules can be tighter. Organisations in scope of the EU's NIS2 directive face earlier reporting deadlines, including an early warning stage, and financial entities often have their own regulator-facing clocks. Contracts add another layer: clients and insurers frequently require notification on shorter timelines than the law does. Read those clauses before you need them.
There is also an employment law dimension. Monitoring staff email or running simulated phishing campaigns touches on privacy and, in several countries, requires consultation with works councils or employee representatives. Keep the purpose documented and the scope proportionate.
None of this is legal advice for your specific situation, and the rules vary by country and sector. If a real incident happens, involve qualified counsel early.
Training is not a tick-box exercise
Annual e-learning that everyone clicks through in October does not stop a December attack. What does help is short, frequent and specific.
- Send a two-minute refresher in late November, focused on the four scams most likely to hit your teams.
- Run simulated campaigns, but use the results to target coaching, not to name and shame. Punishing people for reporting a mistake teaches them to hide the next one.
- Put a working report button in the mail client and make sure someone monitors it during the holidays.
- Reach temps, contractors and seasonal hires. They often have mailbox access and no training history.
- Give finance and HR a written verification rule: any change of bank details, and any payment above an agreed threshold, gets confirmed by a phone call to a number already on file.
The payroll problem nobody wants to talk about
Payroll diversion is the holiday scam with the sharpest human cost. An employee whose salary never arrives is not just an employee who was phished; they may be unable to pay rent in January. Treat the affected person as a victim, not a suspect. Confirm what happened, correct the payment quickly where you can, and check whether the attacker had access to other records.
Prevention is mostly process. Freeze bank detail changes in the ten days before a payroll run unless they are confirmed in person or by call-back. Require two people to approve changes. Log who changed what, and when.
Prepare now for an office that is half empty
Incident response plans fail in December for boring reasons: the person who knows the contact list is skiing, the legal adviser is out of office, and nobody has authority to notify the regulator.
- Publish a holiday rota with a named deputy for the DPO, IT security and communications.
- Give at least two people authority to make the notification decision, with a documented escalation path.
- Pre-draft the notification template: what happened, categories of data, approximate numbers affected, likely consequences, measures taken, contact point.
- Agree in advance who calls external counsel, the insurer and, where relevant, the national cyber security centre or police.
- Test the out-of-hours phone numbers. A rota with a disconnected number is worse than no rota.
- Keep a decision log from the first hour. Regulators ask what you knew and when.
Preserve evidence properly: email headers, mailbox audit logs, sign-in records and timestamps. Do not wipe the affected account in a rush before someone captures the trail.
A short seasonal plan that earns its keep
Before staff disappear, do five things. Send the refresher briefing. Reinstate call-back verification for any payment or bank detail change. Confirm the holiday escalation rota and test the numbers. Remind managers that gift card requests are almost always fraud. And tell everyone, plainly, that reporting a suspected phishing email within minutes is the single most useful thing they can do for the organisation.
Whatever you build for the holidays, keep it running in February. The attackers will.
Photo: BerckenGroep / Pixabay
