Attackers watch the calendar as closely as firm administrators do. Holidays, year-end closings and vacation schedules create conditions that favor fraud: fewer people in the office, more time pressure, unfamiliar substitutes covering for regular staff and a general willingness to move quickly so everyone can get away.
The FBI's IC3 has long warned that business email compromise tends to exploit urgency and routine. The holiday season intensifies both. This guide looks at the patterns to expect and the simple steps that blunt them.
Why the Season Is Risky
- Thin coverage. The person who normally knows a client's habits may be away, so odd requests get less scrutiny.
- Year-end deadlines. Closings, settlements and tax-motivated transactions compress timelines, which makes "urgent" requests feel normal.
- Substitutes and temps. People covering unfamiliar tasks may not know the usual verification steps.
- Increased email volume. Shipping notices, e-cards and charity requests flood inboxes, giving phishing messages cover.
- Fewer eyes on monitoring. Security alerts may sit longer if staff are away.
Scams to Expect
Payment-change requests
A message that appears to come from a vendor, a client or opposing counsel asks to update bank details, often citing a year-end change or new bank. This is a classic pattern. Verify every change by phone using a known number.
Executive impersonation
An email "from" a managing partner, sent while they are traveling, asks an assistant to quickly handle a payment or buy gift cards. Because the real partner is genuinely out of reach, the request feels plausible. Establish in advance that such requests are never handled by email alone.
Fake invoices and shipping notices
Fraudulent invoices from "vendors" and delivery notices with malicious links target the people who handle accounts payable and reception.
Charity and e-card lures
Holiday greetings, donation requests and gift-card offers carry links or attachments designed to install malware or steal credentials.
Closing-related fraud
Real estate and settlement closings that cluster at year-end remain prime targets for spoofed wire instructions.
A Holiday Readiness Checklist
- Remind everyone of the verification rules for wires and payment changes, ideally in a short written reminder before the break.
- Name backups for key roles, and make sure they know the procedures, not just the tasks.
- Tighten wire approvals temporarily, such as requiring two approvers for every outgoing wire, regardless of amount.
- Confirm contact information for your bank's fraud department and for your IT provider's emergency line.
- Make sure alerts are monitored during the holidays, and know who will respond to a security alert on a weekend.
- Disable access for departing seasonal staff and confirm everyone's MFA is working before people travel.
- Review out-of-office messages. Avoid revealing detailed travel plans or who is covering what, since attackers read them.
Guidance for Individuals
- Slow down on any message that adds time pressure.
- Treat unusual payment instructions as suspicious until verified by phone.
- Do not click links in unexpected holiday messages.
- Use work devices only for work, especially when shopping online.
- Report anything odd immediately. A false alarm costs minutes, while a missed scam can cost far more.
If Something Goes Wrong
Act fast. Contact your bank at once to request a recall, notify your IT provider and cyber-insurance carrier, and file a report with the FBI's IC3. Consider client communication duties under Model Rule 1.4 and the guidance in ABA Formal Opinion 483 on breaches. Prepare the contact list before the holiday, not during an emergency.
Remember Supervision
Rules 5.1 and 5.3 address supervisory responsibility for lawyers and nonlawyer staff. A short pre-holiday briefing, with the verification rules restated, is a simple and documented way to show that supervision is real.
How Counsel Cyber Helps
Counsel Cyber provides email security, monitoring and wire-fraud procedures for law firms, with emergency support when staffing is thin. If you would like a quick holiday readiness review, we are happy to help.