43% of UK businesses are receiving scam emails during the festive season

Analyzing hundreds of small to mid-sized organisations the research revealed 83% of employees had received a scam email from an individual pretending to be a senior member of staff - a point raised at Probrand’s IT Expo by famous Youtube Scambaitor, Jim Browning.

Despite this, shockingly only 19% of businesses have tested their employee’s responses to these types of phishing emails and over a third (36%) have taken no action to prevent a future attack.

This is incredibly concerning, with searches for scam emails increasing by 11% over the festive period last year (November-December 2023).

A study by Semperis, stated 86% of businesses experiencing ransomware attacks had it happen during a weekend or during a holiday when staff members were limited and with an average cost of a data breach just over £3.5 million for UK businesses, quieter periods are the most important times to stay vigilant.

Matt Royle, Marketing Director at Probrand has stated: “Scam emails are on the rise, and in the business world these are often labelled as phishing attacks; emails that trick victims into doing something. As businesses prepare for the festive season, it is vital to remain vigilant against potential increased cyber threats.

“The festive period is prime time for cybercriminals, exploiting a busy time followed by a period of reduced staffing with often new tactics like spurious eChristmas cards, that prompt staff to click.

“Our research revealed 48% of UK businesses don’t currently offer cyber security training to staff, and employee awareness is the number one way to lock down threats early.

“That is why it’s so important for UK businesses to provide continuous cybersecurity awareness testing to all employees. This will help keep them consistently aware of the latest tactics being used, and help them identify and act upon cyber attacks to minimise the risk of financial impact on their organisation.

“On top of this, it’s important for businesses to communicate policies and advice during this festive period to minimise risk.”

Below Probrand has provided expert cyber tips on what businesses can do during the festive period to avoid being hacked:

1. Avoid accessing important docus on public WiFi

When staff are travelling home, many often rely on public WiFi networks in airports, trains, and cafes. These networks are frequently unsecured, leaving users exposed to cybercriminals who can intercept sensitive business communications or credentials. If employees are wanting to work while travelling, they should avoid accessing business accounts or confidential files on public WiFi. Remind staff to disable auto-connect features on their devices to avoid connecting to rogue hotspots, while VPNs should also be used to encrypt all data.

2. Educate staff on scam emails

Scammers often leverage the festive spirit by impersonating CEOs or senior executives, requesting gift cards, vouchers, or wire transfers in urgent, seemingly legitimate emails. Known as Business Email Compromise (BEC) it is one of the most common business cyber scams out there. However, it is important to train and educate staff on spotting these emails early on, so provide training on the run up to busier periods and get staff to recognise phishing attempts, including misspelt domains and unusual requests. If they’re unsure of the email, always get them to share it with their line manager, senior member of staff or the IT team for extra precaution.

3. Create a central communication channel

Reduced staff and unfamiliarity with some members of staff can increase the chances of employees falling for phishing attacks. Cybercriminals exploit this by impersonating clients or team members.Create a list of staff that will be working over the festive period to make sure they are all familiar with one another, alongside job titles or roles so they can keep their eyes peeled for email communications from certain individuals. Ensure a central communication channel is available for reporting suspicious activity, even during reduced staffing periods, this can be through a messaging platform your business uses like Microsoft Teams.

4. Have a Crisis Plan

A proper cybersecurity plan acknowledges that attacks may succeed despite your best efforts. That’s why it’s important to have a plan in place for disasters. Having an incident response plan for cybersecurity attacks will help you hit the ground running and minimise the impact of an attack.

81% of businesses that were surveyed didn’t have a valid DR plan to deal with a major Cyber incident, highlighting the gaps that are needed to be filled by small businesses. Putting together a recovery playbook is an essential part of an efficient plan, especially during the festive period.

For more tips on how to protect your business from cyber threats, please visit the Probrand blog page here.