The Holidays Are Open Season for Wire Fraud

Ask your finance person this before Thanksgiving: if a vendor emailed today saying their banking details changed, what would we do?

The answer needs to be a procedure, not an instinct. Instincts get worse when people are covering for absent colleagues and trying to clear invoices before a holiday.

Why This Season

Business email compromise is a patient crime. Attackers get into a mailbox, watch quietly for weeks, learn who approves what and how your invoices are worded, and then wait for the right moment to send one message.

November and December are that moment. Staff are out, approvals are rushed, year end payments are moving, and the person who would normally notice something odd is off until January. Nothing about the attack changes. The conditions around it do.

The invoice will look right. It is supposed to look right. That is the entire attack.

The Two Requests That Should Always Stop

Almost every successful version of this fraud comes down to one of two asks.

• A change to payment details. A vendor updating bank information, a supposed employee changing direct deposit. This should never be actioned from an email alone, ever, no exceptions.
• An urgent transfer from someone senior. Often while that person is conveniently traveling or in meetings and hard to reach. Urgency plus unavailability is the signature.

The countermeasure is unglamorous and nearly foolproof: verify by voice, on a phone number you already had on file, not one supplied in the message. Every time, including when it is genuinely your boss, and including when it is inconvenient.

Make It a Rule, Not a Judgment Call

The reason this works is that it removes the decision. When verification is policy, nobody has to assess whether a particular email feels legitimate, and nobody risks looking paranoid for checking. Put it in writing, tell your team it applies to requests from the owner too, and make clear that following it will never be held against them.

Also worth doing before the holidays: confirm who has authority to approve payments while people are out, and make sure that person knows the rule applies to them.

The Ten Second Version

Ask the question at the top. If the answer includes the word “probably,” you have found this year’s fifteen minute fix.

Where We Fit

Email security, account protection, and staff awareness are part of every partnership we build. But the payment verification rule costs nothing and stops the most expensive attack most small businesses will ever face, so put it in place whether you work with us or not.