School's

Over,

But

Cybercriminals

Are

Just

Getting

Started

Attackers pay attention to the calendar. Out-of-office replies tell them who is away and for how long. Skeleton staffing means approvals get rushed. And more people are working from places and devices that are not the office.

The seasonal weak points

Requests to change bank details arrive while the person who would normally question them is away. Staff check email on personal laptops and home networks with no protection on them. And an out-of-office auto-reply naming a colleague hands over the next target for free.

Sensible precautions

Agree that payment detail changes are verified by phone, on a number you already had, no exceptions and no matter who appears to be asking. Keep auto-replies vague. Make sure remote access requires multi-factor authentication. And confirm that someone is actually watching alerts while the usual people are away, rather than assuming it.