Holiday phishing season

A company I worked with in the past learned about phishing the hard way. The chair of the board got an email that looked routine: someone had shared a document with her. She clicked the link, typed her email password into what looked like the Microsoft 365 sign-in page, and went on with her day. The attackers used that login to get into her mailbox. Nobody noticed anything until the CEO started getting emails from her account, asking to pay invoices that didn't exist.

Nobody in this story was careless. The chair is an experienced person who handles a lot of email. Phishing works best on busy people, and board members and CEOs are some of the busiest people in any company.

Autumn makes everyone busier.

Why Q4 is different

From October to December, a normal company inbox fills up with messages that look exactly like phishing: invoices before the year closes, parcel notifications, Christmas party bookings, gift card orders, year-end documents to sign. When half of your real email says "please pay" or "please log in", a fake one blends right in.

The fakes have also gotten better. The old advice was to look for bad grammar and strange Finnish. That advice is dead. AI writes clean Finnish now, and copying a real supplier's invoice layout takes a few minutes.

So training people to "spot the fake" helps less every year. You still need it, but you can't build your security on the hope that nobody will ever click.

What actually stops it

1. Turn on MFA for every email account, including the board. In the story above, a password alone was enough. With multi-factor authentication, the attackers would have had the password and nothing else. For the people with the most access, go one step further and use passkeys or a hardware security key - those can't be phished through a fake login page at all. Check the board first. Board members are often outside the company's normal IT setup, with their own laptops and sometimes their own email.
2. Make a payment rule that doesn't depend on email. Any change of bank account number, or any "urgent" payment request, gets confirmed by phone using a number you already had - never the one in the email. Write the rule down and tell the people in finance that nobody will ever be annoyed with them for calling to check. This one costs nothing.
3. Get alerts for the quiet part of the attack. Once attackers are in a mailbox, they rarely do anything loud. They set up a forwarding rule, or a rule that hides certain replies, and they wait for an invoice conversation to hijack. Microsoft 365 and Google Workspace can both alert you when someone creates a forwarding rule or signs in from an unusual country. In most small companies I've seen, these alerts are either off or going to a mailbox nobody reads.

None of this is exciting. It's mostly settings and one phone call habit.

Here's a question worth asking before Christmas: who in your company can still log in to email with just a password? If you don't know the answer, the attackers will find out for you.

Phishing season can't be canceled. But you can make sure a single typed password isn't enough.

---

Not sure how your company's email is set up? BandIT does a free email security check: we look at who can still sign in with only a password and whether anyone would notice an attacker sitting in a mailbox. Get in touch to book one.