The holidays are supposed to be the time of year when you finally unplug.
But for many small and mid-sized business owners, the reality looks more like this:
- You are on "vacation" but secretly checking email between airport gates
- Your team is pinging you with "quick questions" because only you know how to approve payroll or reset that one system
- Meanwhile, cybercriminals are delighted that key people are out and everyone is a little distracted
As Stimulus Technologies CEO Nathan Whittacre puts it, hackers know holidays are a "great opportunity to infiltrate your organization, especially when key people are out of the office."
In two recent episodes of Stimulus Tech Talk, we explored both sides of holiday cybersecurity:
- How to vacation proof your technology and processes, so the business can run while you are off the grid
- How to protect your team from holiday scams, including gift card scams, payroll fraud and vendor ACH changes
This post pulls the big ideas together. If you want to go deeper, you can watch or listen to both full episodes at the end of this article.
Why Holidays Are High Risk For Small Business Cybersecurity
Time off is not just a scheduling problem. It is a cybersecurity problem.
In our vacation-proofing episode, Nathan shared the story of taking two weeks completely off the grid in 2018:
"I did not have any technology with me other than a satellite messaging device... I certainly did not have access to the internet or computers for two weeks."
To make that possible, he had to confront two big risks most business owners face.
1. Impersonation risk when you are out of office
When you turn on an out-of-office reply in email, you are not just telling your customers you are gone. You are telling everyone, including attackers.
Hackers notice that the CEO, controller or accounting manager is unavailable. They will start emailing or texting your team pretending to be that person, asking them to:
- Buy gift cards
- Change vendor ACH or direct deposit details
- "Urgently" send a payment to a new bank account
As Nathan explained, they use that out-of-office signal to "convince [your team] to pay a bill that is not real" or wire money to a fake vendor.
Attackers can also learn you are gone from social media. If you post vacation photos in real time, you are giving them a perfect window to exploit.
2. Single point of failure in your systems and knowledge
Many businesses quietly depend on one person who:
- Approves all payments
- Knows all the passwords and multi-factor authentication details
- Understands how to recover systems in an incident
When that person is unreachable, on vacation or on leave, everything stops. Or worse, people start improvising, which increases cybersecurity risk.
Nathan admitted he had "a lot of institutional knowledge" in his head before that two-week backpacking trip. The trip forced him to document and delegate so the company could operate without him.
Both of these issues get worse during the holidays, when:
- People are rushing to finish work before vacation
- Teams are short-staffed
- HR and accounting are buried in year-end tasks
- Everyone is clicking on more links than usual, including shipping notices, sales emails and benefits updates
From a cybersecurity standpoint, that combination is a perfect storm.
How To Vacation Proof Your Business Before You Travel
Before you worry about specific holiday scams, you need a business that can function when you are not available.
Nathan’s advice to business owners is straightforward:
"Get things documented and get a team in place that can execute on it well so that you can go away and not worry."
Here is what vacation proofing your business looks like in practice.
Remove yourself as the single point of failure
Ask yourself:
- Who approves payroll if I am out?
- Who can approve vendor payments if I am offline?
- Who can log into banking, HR, and key business systems?
If the answer is "only me" or "only that one IT person," you have a significant cybersecurity and operational risk.
Action steps:
- Set up backup approvers for payroll and vendor payments
- Make sure there are at least two people who can access critical systems
- Use multi-step approvals for large or unusual payments, especially ACH transfers and wire transfers
Nathan is very clear: when an owner or CFO goes away, you want to keep "two levels of authentication inside all those financial approvals."
Document critical knowledge and access
You do not need a huge policy manual, but you do need key information written down and stored securely.
At a minimum, document:
- Access and credentials for critical systems (secured in a password manager, not a spreadsheet)
- Steps for paying vendors, running payroll and approving large payments
- Steps for restoring backups, responding to ransomware and handling accidental deletions
Nathan explains that one of the big lessons from his two-week trip was:
"It was a good opportunity for me to get a lot of things out of my head... I wrote a lot of documents during that time."
Use a password manager instead of spreadsheets and sticky notes
Password management is at the core of vacation proofing and cybersecurity.
Nathan strongly recommends using a dedicated password manager, not web browser password storage or Excel sheets:
"If you have Chrome or Firefox or Safari or Edge pop up and say, 'Do you want me to store this password for you?' do not do that. Use a good password manager."
He highlights tools like LastPass, 1Password and Bitwarden because they:
- Encrypt passwords in a secure vault
- Allow shared access for teams
- Track who accessed which credentials and when
- Allow you to quickly revoke access if someone leaves
By contrast, sticky notes and spreadsheets are still surprisingly common:
"Yes, I am still seeing sticky notes in people's offices. It drives me nuts. You might as well not really actually have a password."
Build an Incident Response Playbook Before You Need It
If something goes wrong while you are out, your team should not be inventing the response from scratch.
Instead, they should be able to "pull out the emergency manual and follow that," as Nathan describes.
That is where an incident response playbook and tabletop exercises come in.
What is a tabletop exercise?
Nathan explains it this way:
"That is what is called tabletop exercises... you say, 'Okay, this happened today. What are we doing now?' and you go through it with the team."
In a tabletop exercise, you simulate a cybersecurity or IT incident, such as:
- A ransomware attack
- A major outage
- A lost or stolen laptop
- An employee falling for a phishing email
Then you walk through your documented response step by step:
- Who is notified
- What systems are checked
- Which backups are used
- Which external vendors are called
These exercises usually take 30 to 60 minutes but are invaluable for finding gaps, outdated contact information and unrealistic assumptions.
Nathan notes that tabletop exercises are now part of many compliance and cybersecurity frameworks and should be done regularly, such as quarterly, twice per year or annually.
Common Holiday Scams That Target Small Businesses
In the second episode, we focused specifically on holiday scams that target both individuals and businesses.
Nathan sees two patterns over and over: distraction and urgency.
"They know that you are distracted, and they are trying to create a sense of urgency to take advantage of you in that moment."
Here are some of the most common holiday-themed scams.
Gift card scams that appear to be from executives
These scams usually look like:
- A short, urgent email or text that appears to come from the owner or CEO
- Language such as "Are you available? I need a quick favor"
- A request to buy gift cards and send back the codes, often framed as a surprise for staff or clients
The risk is highest when:
- Your out-of-office message is turned on
- You are openly posting about travel on social media
- Employees already feel pressure to support leadership and move fast
Before you travel, Nathan suggests proactively warning your team:
"If you get any communication from me... I am not going to send a random text message asking for ten Amazon gift cards while I am backpacking."
Setting that expectation in advance makes it much easier for employees to question suspicious messages, even if they "look like" they are from you.
Fake package and shipping notifications
During the holidays, almost everyone is expecting deliveries. Attackers exploit that by sending:
- Fake "we cannot deliver your package" text messages
- Phishing emails that look like they are from UPS, FedEx, USPS or Amazon
- Links that lead to credential theft or malware
Nathan even admitted that in a phishing training exercise, he clicked on a fake shipping email because he was legitimately expecting a package at the time.
Teach your employees to:
- Go directly to the carrier website or app and enter the tracking number
- Be skeptical of messages that demand immediate action to avoid a delivery problem
- Avoid clicking on shipping links in unsolicited texts and emails
Direct deposit, payroll and vendor ACH scams
This is where holiday scams can get very expensive, very quickly.
At year end, HR and accounting teams are flooded with:
- Address updates
- Direct deposit changes
- W-2 and 1099 preparations
- Vendor banking updates
Attackers slip into that normal activity by sending believable emails that request:
- Employee direct deposit changes
- Vendor ACH changes to a new bank account
Nathan shared a real example from Stimulus Technologies:
A vendor's email account was hacked and used to send fraudulent ACH change requests. Because he called his normal contact at that company, he confirmed the request was fake before changing any payment details.
His rule is clear: never rely on email alone for financial changes.
Always verify change requests through:
- A phone call to a known, pre-validated number
- A secure portal with multi-factor authentication
- A secondary approval process
Strengthen Banking, HR and Remote Access Before the Holidays
If you only take one technical step to improve holiday cybersecurity, Nathan recommends this:
"Log into banking websites to ensure that you have multi-factor authentication turned on, both for your business and your personal accounts."
In addition, review:
- Contact information on all banking and HR accounts to ensure phone numbers and backup emails are correct
- All users who have access to business banking, payroll and HR systems to confirm they still work for you
- Security settings in HR, payroll and benefits systems, including multi-factor authentication and login alerts
Be careful with personal devices and public Wi-Fi
Holiday travel often means people are working from:
- Personal laptops
- Shared home devices
- Hotel and airport Wi-Fi
Nathan does not recommend using personal laptops directly for business work while traveling, especially over public Wi-Fi. Instead, he suggests:
- Using a virtual desktop environment such as Windows Virtual Desktop, accessed securely from your personal device
- Using a company-managed laptop with proper security controls whenever possible
This keeps company data inside a controlled environment, not scattered across unsecured personal devices.
Train Employees To Slow Down And Report Incidents Quickly
Technology is important, but culture is what really protects your business from scams and cyberattacks.
Across both episodes, Nathan returned to one core behavior:
"Just slow down and take a moment to verify."
Build this into your cybersecurity training:
- Encourage employees to question unusual requests, especially anything involving money, gift cards or payment changes
- Require verification through known channels, not the reply-to address or phone number in a suspicious message
- Make it clear that if someone clicks on something or sends information by mistake, you want them to report it immediately
Trying to hide a mistake usually makes the situation worse. As Nathan said:
"Report it quickly... trying to cover it up or solve it yourself can cause more harm than the original mistake."
The faster your IT or security team hears about a potential incident, the more likely it can be contained with minimal damage.
Turn This Holiday Season Into A Real Test And A Real Break
The holidays are actually a great time to test how resilient your business really is.
Ask yourself:
- Could I be unreachable for a few days without stopping payroll or payments?
- Does my team know how to respond if there is a cybersecurity incident while I am out?
- Are our approvals, passwords and multi-factor authentication set up to prevent impersonation scams?
If the answer is "not yet," you have a practical starting point:
- Document access, passwords and key processes in a secure system
- Set up backup approvers and shared, secure access for critical systems
- Turn on multi-factor authentication for banking, HR and key business applications
- Train employees on the most common holiday scams that target small businesses
- Encourage staff to slow down, verify requests and report suspicious activity immediately
The upside is significant. As Nathan explained:
"You have to be refreshed and charged... taking that time away allows you to reset and be your best when you come back."
Watch Or Listen To Both Stimulus Tech Talk Episodes
If you are thinking, "We are not ready for this holiday season," you are not alone. The good news is that you can start improving your cybersecurity posture right now.
We recommend watching or listening to these two episodes of Stimulus Tech Talk with your leadership, HR, finance and IT teams:
- Episode: Vacation Proofing Your Tech
Learn how Nathan prepared to go completely offline for two weeks, what he documented and how to build a company that does not depend on one person for critical access and decisions. - Episode: Holiday Scams - Gift Cards, Fake Packages and Payroll Fraud
Hear about real-world scam attempts, including package phishing, direct deposit fraud and executive impersonation, and learn what to teach your employees before the holiday rush.
You can find both episodes on the Stimulus Technologies website or wherever you listen to podcasts. Use them as a starting point for your own holiday cybersecurity and vacation-proofing plan.
If you would like help implementing any of these protections for your organization, the team at Stimulus Technologies is ready to support you.
