The five most important cybersecurity habits employees should follow during the holidays are slowing down on urgent requests, verifying unusual asks before acting, following company security policies while traveling, avoiding suspicious links in holiday emails and knowing exactly who to contact when something feels off.
Cybersecurity habits don't disappear over the holidays. They just get harder to maintain. Employees are clearing inboxes before PTO, working from airports and hotels, handling requests outside the normal routine and dealing with more noise in their personal and work email than usual. That combination creates real openings for scammers and phishing attempts.
A quick security reset before holiday schedules kick in is one of the most practical things a business can do this time of year. Here's what to put back on everyone's radar.
1. Slow down when something wants you to hurry
Urgency is one of the most reliable tools scammers use, and it works especially well during the holiday rush when everything already feels time-sensitive.
"Can you take care of this before you head out?" "Payment is needed by EOD." "I'll be out the next two days — handle this before I'm back."
When the whole office is in wind-down mode, urgent requests don't stand out the way they should. But a manufactured sense of urgency is designed to override skepticism and push people to act on instinct. The more pressure there is to move fast, the more reason to stop and verify.
2. Verify the "quick favor"
High-stress, high-volume periods make most employees want to be accommodating. That instinct is worth watching.
Any request for sensitive information — account credentials, payment details, personal data — needs to be verified before acting on it, regardless of who appears to be asking. If you recognize the sender, contact them directly by phone or a separate trusted channel. If you can't confirm the request, follow your company's process for protecting sensitive information while keeping things moving.
Taking an extra minute to verify will always be better than getting an answer out a minute faster when that answer puts the business at risk.
3. Don't let convenience take over when you travel
Hotels, airports and coffee shops introduce security risks that the office network doesn't. That doesn't mean employees shouldn't get work done while traveling. It means they need to follow company policies for connecting securely when they do.
A few things worth reinforcing before employees head out: what networks are approved for work use, what can and cannot be accessed from personal devices and which tools are approved for business tasks. Shadow IT, software employees use for work that hasn't been approved by the company, tends to increase when people are working outside their normal environment. A quick reminder before travel season starts goes a long way.
4. Think before you click holiday bait
Holiday phishing attempts are designed to blend in. Shipping confirmations, travel itineraries, order receipts, loyalty rewards. In a busy inbox, a well-timed fake email can look completely legitimate.
Even for emails you're expecting, check the sender address and hover over links before clicking. Better yet, go directly to the website or provider instead of following a link in an email. Phishing works because most people never stop to consider that something might be off. That pause is the habit worth building.
5. Know who to ask when something feels off
All of the above comes down to one thing: knowing where to turn when something doesn't look right.
Even the most careful employee will encounter something they're not sure how to handle. When that happens, there needs to be a clear answer. Who do you contact when a phishing message shows up? What's the process if a suspicious link gets clicked? What needs to happen next?
These questions involve more than one person. Make sure employees know the reporting process before they need it, not after.
Keep it brief, keep it practical
Nobody needs another hour-long training session the week before a holiday. A short, specific reminder focused on what employees are likely to encounter over the next few weeks is more useful than a comprehensive review.
Slow down on urgent requests. Verify anything unusual. Follow security policies while traveling. Know who to call when something feels wrong. That's the message.
If you'd like help making sure remote access, device policies and reporting processes are ready before holiday travel begins, we're happy to take a look. Schedule a 15-minute discovery call at goodwinpc.com or call us at 901-550-2142.
About Goodwin PC Services
Goodwin PC is a locally owned managed IT provider serving small and mid-sized businesses across the Mid-South, including Memphis, Olive Branch, Hernando and Corinth. Named to the MSP 501 seven consecutive years, our team responds to cybersecurity concerns within 15 minutes, answers every call live and helps businesses build security habits that hold up year-round.
Frequently asked questions
Why are cybersecurity threats more common during the holidays?
Scammers target the holidays because employees are distracted, inboxes are busier than usual and urgency feels normal. That combination makes it easier to slip a phishing attempt or fraudulent request past someone who would otherwise catch it.
What is shadow IT and why does it matter during the holidays?
Shadow IT refers to software or tools employees use for work that haven't been approved by the company. It increases during travel and remote work periods because employees reach for convenient tools rather than approved ones. Unapproved tools can create security gaps the IT team doesn't know about.
What should employees do if they accidentally click a suspicious link?
They should report it to their IT team or manager immediately, not wait to see if anything happens. The faster a potential incident is reported, the more options the IT team has to contain it.