The Riskiest Quarter of the Year

Every security team knows the feeling: the calendar turns to November, the whole company starts tracking packages and chasing discounts, finance sprints toward year-end close — and the phishing reports start piling up. That instinct is backed by hard numbers. Darktrace's analysts tracked a 620% surge in Black Friday-themed phishing in the weeks before the 2025 holiday weekend, measured across 6,500 protected email environments. The FBI's Internet Crime Complaint Center, for its part, logged almost 12,000 victims and over $73 million in losses in the 2022 holiday shopping season alone — and its holiday warnings have returned, expanded, every year since.

Most of that coverage treats holiday phishing as a consumer problem. It is not — or rather, it does not stay one. The same employees shopping on lunch breaks are the ones approving invoices, resetting passwords, and clicking delivery links on corporate laptops. With the Verizon DBIR attributing 62% of breaches to the human element, a season that measurably degrades human vigilance is an enterprise risk event, not a retail story. Here is why the fourth quarter concentrates so much human risk, and what to do about it before the rush peaks.

Three forces that converge in Q4

A season of ready-made pretexts. Phishing works when the lure matches what the victim already expects, and no period hands attackers more expected email than November and December. Darktrace's data shows phishing impersonating US retailers running 201% higher in mid-November than the same week in October, with Amazon alone accounting for 80% of consumer-brand impersonation. A fake order confirmation in July invites suspicion; in late November it looks like the other six in the same inbox.

Year-end business pressure. Q4 is budget-flush season, closing season, and deadline season. Attackers exploit that tempo directly: urgent gift card requests from a "CEO" buying staff presents, supplier emails announcing changed banking details before the books close, payroll-diversion requests timed to bonus runs. These are the corporate cousins of the consumer lures — gift card scams and invoice fraud both spike when urgency is plausible and approvers are distracted. Our guide to invoice fraud prevention covers the verification controls in detail.

Defenders go home. The FBI and CISA have warned since 2021 that ransomware operators deliberately time attacks to holidays and weekends, when offices are empty. The pattern has not aged: in Semperis' 2025 Ransomware Holiday Risk Report, a majority of organizations hit by ransomware were attacked on a holiday or weekend — and 78% admitted cutting SOC staffing by half or more at exactly those times, with 6% going completely dark. Attackers do not take the holidays off; they schedule around yours.

The holiday threat isn't one attack. It's ordinary attacks arriving when pretexts are most believable, employees are most distracted, and defenders are least available.

The Q4 lure calendar

Seasonal phishing follows the retail calendar closely enough to plan against. These are the themes worth building awareness content and simulations around, in the order they peak:

Theme	Peak window	What it looks like	The tell
Deal and discount lures	Early–late Nov	"Exclusive early access", brand-spoofed sale emails, lookalike shops	Pressure to click now; domain is not the retailer's
Fake order confirmations	Late Nov–Dec	"Your order of $349 has shipped" for something never bought	Designed to provoke a panicked "cancel order" click or call
Delivery smishing	Late Nov–Dec	SMS: package held, small customs or redelivery fee due	Carriers don't collect fees via text link
Executive gift card requests	Dec	"Are you at your desk? Need gift cards for the team, keep it quiet"	Urgency plus secrecy plus an unusual channel
Invoice and banking changes	Mid-Dec–early Jan	Supplier "updates" payment details before year-end close	Any change requested exactly when verification is hardest
HR and benefits bait	Nov–Dec	Bonus letters, open-enrollment deadlines, holiday schedules	Credential prompt behind an internal-looking link
E-cards and charity appeals	Dec	Greeting-card links, disaster or giving-season donation requests	Unexpected sender; pressure tied to goodwill

Two details make this calendar more dangerous than it looks. First, the channels have multiplied: the FBI's recent holiday warnings cover not just email but social media ads, fake retail sites, QR codes, and phone calls — a fake delivery SMS can reach an employee on the same phone that holds their corporate authenticator. Second, the consumer/corporate boundary is gone. An employee who enters card details on a counterfeit shop may reuse the same password at work; a personal mailbox flooded by email bombing can be the setup for a fake IT-support call on Monday.

Why the work inbox is not exempt

It is tempting to file all of this under personal risk and move on. Three realities argue otherwise.

Employees shop at work. Browsing, order tracking, and deal-hunting happen on corporate devices and networks throughout November and December, which means consumer-themed lures land — and get clicked — inside the perimeter. The rushed, divided attention that makes holiday shoppers careless is a cognitive state, and it does not switch off between tabs.

Out-of-office replies feed pretexting. Every auto-reply naming a colleague "for urgent matters" hands an attacker a ready-made social engineering script: who is away, until when, and who is covering with less context and more pressure. December's org chart, as advertised by OOO messages, is an attacker's reconnaissance gift.

Skeleton crews break process. Payment approvals, access requests, and password resets still happen between Christmas and New Year — handled by whoever is around, often outside normal workflows. "The usual approver is on leave" is exactly the gap callback phishing and BEC crews are built to exploit.

A Q4 hardening playbook

The good news: the seasonal spike is predictable, which makes it one of the few threats you can prepare for on a calendar. Six moves, ordered by when they should happen.

1. Run a seasonal simulation wave in November. Train on the lures employees will actually face: a delivery notice, a benefits deadline, an e-card. A phishing simulation themed to the season, launched before Black Friday, both inoculates and baselines. Skip punitive fake-bonus lures — they generate resentment, not recognition.

2. Pre-brief the gift card and payment rules. One short message to the whole company, and a sharper one to finance: no executive will ever request gift cards by email or text; every change to supplier banking details gets verified by a call to a known number; year-end urgency is a red flag, not a reason to skip steps. Written policy beats in-the-moment judgment when pressure is high.

3. Set an OOO hygiene standard. Keep auto-replies minimal: no internal phone numbers, no detailed coverage chains, no return dates on external-facing replies where avoidable. Small change, real reduction in pretexting material.

4. Publish the coverage calendar. Decide now who is on call for the holiday weeks, how an employee reports something suspicious on December 26, and what the escalation path is when the SIEM alerts at 2 a.m. on New Year's Day. Semperis' data says most of your peers will be running half-staffed; being deliberate about it is what separates a quiet holiday from a crisis discovered on January 2.

5. Push the report reflex hard. The metric that matters in Q4 is not click rate but report rate — an employee who forwards a fake delivery text gives the security team hours of warning it would not otherwise have. Make reporting one tap, answer every report, and say thank you publicly.

6. Measure the season, not just the month. Track failure and report rates from November through mid-January as one campaign, per team and per lure theme, and feed the results into your human risk score. The teams that struggled with delivery smishing in December are telling you where January's targeted training belongs.

The January test

Holiday phishing season ends; the data it generates should not. When the decorations come down, you will have something rare — several weeks of employee behavior under realistic, high-pressure attack conditions. Compare it to your October baseline. If report rates held up while attack volume spiked, your program is working. If clicks clustered in specific teams, themes, or hours, that is next quarter's roadmap written for you.

Q4 is the riskiest quarter because three curves — attacker opportunity, employee distraction, and defender availability — all bend the wrong way at once. None of them can be flattened entirely. But every one of them can be anticipated, and the organizations that treat the holiday season as a scheduled security event, with the same planning energy they give year-end close, enter January with fewer incidents and better data than the ones that just hoped.