It is December 23rd. Your controller is out until the 2nd. The person covering accounts payable has done it twice before, both times in July, with someone sitting next to her.
An email arrives from a vendor you have paid every month for four years. Updated banking details, invoice attached, and a line near the bottom: we’re closing the books before the holiday, can you get this one processed today?
Everything about that message is designed to work on December 23rd and nowhere else. The urgency is plausible because everything is urgent in late December. The person who would normally catch it is skiing. And the one thing that would settle it — a phone call to a number you already have — feels like an imposition on a day when nobody wants to be bothered.
This is the part of holiday security that actually matters, and it has very little to do with buying anything.
The number worth carrying into the conversation
The FBI’s 2025 Internet Crime Report logged 1,008,597 complaints and $20.877 billion in reported losses for the year.
Inside that total, business email compromise accounts for 24,768 complaints and $3,046,598,558. Divide one by the other and the average reported BEC loss is roughly $123,000 per complaint.
That is the number to sit with. Not because every incident costs that, but because it is the wrong order of magnitude for a business that budgets security in hundreds of dollars a month. One successful vendor-payment redirect costs more than most DFW companies spend on their entire security stack in a year.
And BEC is specifically the attack that works best when the people who know what normal looks like are out of the office.
Why the holidays, specifically
This isn’t folklore. The FBI and CISA issued a joint advisory, Ransomware Awareness for Holidays and Weekends, making the mechanism explicit: attacks have been more impactful over holidays and weekends “when offices are normally closed,” and attackers get a head start precisely because defenders and IT support are “at limited capacity for an extended time.”
The advisory dates from 2021 and its examples are from that year — DarkSide over Mother’s Day weekend, REvil over Memorial Day and the Fourth of July. Worth saying plainly: it’s five years old. But the reasoning it describes hasn’t aged at all, because it isn’t about a particular gang or a particular tool. It’s arithmetic. An intrusion that starts Friday at 6pm and isn’t noticed until Monday has sixty-two hours to work. One that starts December 23rd has closer to ten days.
Nothing in your stack changes over the holidays. What changes is how long anything gets to run before a human looks at it.
Habit one: urgency is the tell, not the context
Every social-engineering attempt needs you to act before you think. In December, the cover story writes itself — year-end, closing the books, out of office tomorrow, the vendor needs this before the holiday.
The useful reframe is this: the more a message insists on speed, the more it has told you about itself. Urgency is not a reason to hurry. It is the single most reliable indicator that you should slow down.
Worth naming the specific phrasings, because people recognise them once they’ve seen them written down:
- Can you take care of this real quick before you head out?
- Payment needs to go out by end of day.
- I’ll be out the next two days — I need this handled before I’m back.
- Updated banking details, please use going forward.
The last one is the expensive one. The others cost you time. That one costs you the invoice.
Habit two: verify out of band, with a number you already had
“Verify the request” is advice everyone has heard and almost nobody has operationalised. The part that makes it work is three words long: out of band.
Not a reply to the email. Not the phone number in the signature. Not the number on the attached invoice. A number you already had before the message arrived — from the signed contract, from your accounting system, from the last time you called them.
Attackers who have compromised a mailbox control everything inside the thread, including the “verification” you send back to it.
Make it a rule with no judgment attached: any change to payment details, any new payee, and any transfer above a threshold you pick gets a phone call to a known number, every time, no exceptions for who asked or how busy it is. A rule with exceptions is a rule that fails in December, because December is when every exception seems reasonable.
The thing almost nobody checks: the rule left behind
When an attacker gets into a mailbox, the wire transfer is rarely the first move. The first move is usually quieter: a rule that forwards a copy of everything, or everything matching “invoice” and “payment,” to an address outside your company. Then they wait and read.
A rule set on December 22nd has a very long runway. Nobody is reviewing mailbox rules between Christmas and New Year.
Most DFW businesses running Microsoft 365 can close the main version of this door in about five minutes, and many don’t know the setting exists. In the Microsoft Defender portal it lives in the outbound spam filter policy, under Protection settings → Automatic forwarding rules. Microsoft’s documentation lists three values:
- Automatic – System-controlled — the default, and the trap. Microsoft says its behaviour “varies by organization”: it may be On for some existing tenants and Off for newer ones. If you have never looked, you do not know which one you are.
- On — automatic external forwarding is allowed and unrestricted.
- Off — it’s blocked, and the sender gets an NDR:
5.7.520 Access denied, Your organization does not allow external forwarding.
Microsoft’s own recommendation is to set this explicitly rather than leave it on Automatic. Internal forwarding between your own users isn’t affected, so for most small businesses turning it off breaks nothing and removes an entire category of quiet persistence.
One question to your IT partner this month: is automatic external forwarding set to Off in our tenant, and if not, why not?
The Texas part: the clock doesn’t observe the holidays
This is the piece that should change how you plan December, and it is specific to doing business here.
Under Texas Business & Commerce Code §521.053, a business that owns or licenses computerized data containing sensitive personal information must notify affected individuals of a breach without unreasonable delay and no later than the 60th day after the date the business determines the breach occurred.
And §521.053(i) adds a second, tighter clock: if the breach involves at least 250 Texas residents, you must notify the Texas Attorney General — electronically, on the AG’s form — as soon as practicable and no later than the 30th day after you determine the breach occurred.
Read those two dates against a calendar. A breach you determine on December 22nd puts the Attorney General notification due around January 21st, and individual notification around February 20th. Those are calendar days. The statute has no provision for the fact that your office was dark for ten of them, your attorney was unreachable, and the person who could have determined anything was in Colorado.
The penalties aren’t abstract either. §521.151 provides a civil penalty of $2,000 to $50,000 per violation, and for failing to take reasonable action to comply with the notification requirement, up to $100 per affected individual per day, capped at $250,000 for a single breach.
So the genuinely useful holiday question isn’t “are we protected.” It’s who, between December 20th and January 2nd, is authorized to determine that a breach occurred? Because that determination is what starts both clocks — and a company that avoids making it in order to avoid the deadline has not avoided anything. It has just started the clock later while the damage compounds.
We’re an IT firm, not a law firm. Confirm the specifics with your attorney.
What holiday coverage actually looks like
Four things, none of which require a purchase order:
- Someone is named. Not “IT” — a person, with a phone number, who is reachable and who knows they are the one.
- That person can decide. Authority to shut something down, lock an account, or stop a payment without waiting for an executive who is on a plane.
- Alerts route somewhere a human sees them over the break. A dashboard nobody opens until January 5th is not monitoring.
- Everyone else knows the two rules: verify banking changes by phone to a known number, and report the odd message rather than quietly deleting it.
That last one matters more than it sounds. Most holiday incidents were seen by somebody who wasn’t sure it was worth mentioning on December 23rd.
This is the work behind Fulcrum’s First Look — an outside read of who is actually watching what — and STARMap, our word for the roadmap that turns that into a plan with owners and dates. It runs through our managed security and managed IT services work: the tools are rarely the gap. The gap is the ten days nobody agreed to cover. Cheap IT saves cents. Smart IT makes dollars.
Two things to do this week
Write down who covers what, December 20th to January 2nd. Names, mobile numbers, and what each person is allowed to decide alone. One page. Send it to everyone before the first person leaves, not after.
Check the forwarding setting. Ask whether automatic external forwarding is explicitly Off in your Microsoft 365 tenant. If the answer is “it’s on Automatic,” you have found something worth five minutes.
Where this usually goes sideways
The common failure is assuming coverage exists because nothing has gone wrong in previous Decembers. Quiet Decembers are evidence about those Decembers, not about your arrangements.
The second is treating this as an employee-awareness problem. Training helps, but a person covering a role they do twice a year, on a skeleton crew, under genuine time pressure, is not going to out-think a well-built BEC attempt. The controls that work are structural: the phone-call rule, the forwarding setting, the named person who can act.
Attackers aren’t working harder in December. They’re working the same, against far fewer people who are watching.
Not sure who’s covering what over the holidays?
Book a First Look and we’ll map it with you — who watches which alerts, who can act, and what happens between December 20th and January 2nd. A clear picture, no products to buy at the end of it.
Call 817-337-0300, email sales@fulcrumgroup.net, or start with the podcast — Talk To Th3 Doc — if you’d rather listen first. More like this on the blog.
The Fulcrum Group · Keller, Texas since 2002 · fulcrumgroup.net
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report — 1,008,597 complaints and $20.877 billion in reported losses for 2025; business email compromise 24,768 complaints and $3,046,598,558. The ~$123,000 average is our arithmetic. Accessed October 2026.
- FBI and CISA, Ransomware Awareness for Holidays and Weekends (AA21-243A), August 2021 — attacks more impactful when offices are closed; defenders and IT support at limited capacity for an extended time.
- Microsoft Learn, Control external email forwarding — Automatic forwarding rules in the outbound spam filter policy; the Automatic – System-controlled default varies by organization; blocked forwarding returns NDR 5.7.520. Accessed October 2026.
- Texas Business & Commerce Code §521.053 — individual notification without unreasonable delay and not later than the 60th day after determination; Attorney General notification not later than the 30th day where at least 250 Texas residents are involved.
- Texas Business & Commerce Code §521.151 — civil penalty of $2,000 to $50,000 per violation; up to $100 per individual per day for failure to comply with §521.053(b), capped at $250,000 for a single breach.
