Compliance & Ethics Awareness Week 2025
Ethics and Compliance
When the holidays roll around, the mix of distraction and disruption creates an ideal setup for phishing and other cyber threats.
Employees are often juggling personal and professional tasks on the same devices, such as booking travel, approving last-minute invoices, checking work email from the airport and shopping online. With organizations also running on reduced staff, cybercriminals see the holiday and vacation season as the perfect time to launch their attacks.
Phishing emails and fake websites often play on familiar seasonal themes: “Your flight itinerary has changed,” “Confirm your hotel payment” or “Track your holiday package here.”
Recent data shows just how active these scams are during the holidays.
- Analysis from TransUnion found that 5.3% of all digital transactions in the U.S. over Thanksgiving through Cyber Monday 2024 were suspected fraud attempts.
- According to SEON, bot attacks on e-commerce sites surged 407% during Black Friday week and another 526% during Christmas week last year.
- And during the 2023 holiday shopping period, Norton reports malvertising attacks rose 53%, while adware incidents jumped 227%.
How AI is changing the game
Phishing remains the number one cause of data breaches, and with more showing signs of AI-assisted generation, they’re becoming more polished, personalized and difficult to spot.
Imagine a well-crafted email arriving from a travel provider about your upcoming company trip, urging you to “reconfirm payment details.” Or a deepfake voicemail from your CFO instructing a finance manager to wire funds to a “new vendor” while the executive is supposedly abroad. These scams are increasingly common.
Other examples include fake delivery notifications, fraudulent vendor invoices timed to year-end budget rushes and cloned websites offering “exclusive holiday discounts.” Attackers rely on urgency and distraction, knowing people are more likely to click when they’re busy, traveling, or multitasking.
Get cyber-ready before the holiday rush
Pre-holiday preparation is key. Before everyone signs off, run a security check:
- Review user access privileges.
- Confirm that multi-factor authentication (MFA) is enabled across systems.
- Verify vendor and contractor permissions.
It’s also a good time for a quick cybersecurity refresher. A short, targeted reminder for employees on key security practices, like spotting phishing emails, using strong passwords, and verifying unusual requests, helps reinforce good habits before the holiday rush.
Also conduct internal phishing simulations. These controlled tests are a low-stakes way to see who might need additional coaching and to raise awareness about the kinds of scams circulating this time of year.
In addition, security teams should monitor for unusual patterns, including suspicious logins, spikes in invoice activity, or sudden vendor banking changes, and designate someone on call to handle potential incidents during the break.
A little bit of skepticism is smart this time of year. If a message involves money, credentials or urgency, verify it first. The payoff? Peace of mind and the freedom to enjoy the holidays without scrambling to recover from a preventable breach.
