Half the office is on vacation — and attackers know it

"Thank you for your email. I'm out of the office until Monday, August 3, with limited access to email. For urgent invoices, please contact Dana in accounting at [email protected]."

Polite. Professional. And to the wrong reader, a work order: who's away, until exactly when, who handles the money in the meantime, and the precise address to aim at.

What an auto-reply hands a stranger

Security-training firm Hoxhunt broke down what an attacker extracts from a typical out-of-office reply: your return date (their window), your backup contact (the person making decisions in your absence), and that contact's email address (exactly where to send the fake).

Here's how it plays out. Mid-week, the attacker emails Dana with the owner's name on it: "I know I'm away — this vendor payment needs to go out before Friday. Can you handle it? I'm hard to reach." Every detail that makes the message believable came from the auto-reply. Dana is covering an unfamiliar job, the request matches what she was told to expect ("urgent invoices"), and the one person who could confirm it is on a beach.

The "confirm your vacation request" email

The other half of the summer playbook arrives before anyone leaves. In early-July reporting from NBC 10, scam researcher Steve Weisman of Bentley University warned that fraudsters are now posing as HR, emailing or texting employees to "confirm" an upcoming vacation request. The link leads to a fake login page or a malware download. It works, Weisman notes, because employees really do get legitimate HR emails about vacation this time of year.

Kaspersky has documented the same pattern in detail: an email supposedly from HR about a sudden change to the vacation schedule, a link dressed up as a PDF, and a login page hosted somewhere with no connection to your company. You don't need an HR department to be a target — at a 20-person company the same email just says "updated vacation calendar" and appears to come from the office manager.

Why they run this play in July

Payment fraud depends on verification breaking down, and summer breaks it naturally. The person who normally approves transfers is unreachable. The person covering doesn't know what a normal request looks like. Nobody wants to interrupt the boss's first real week off over "one invoice."

The stakes aren't small. The FBI's Internet Crime Complaint Center logged just over $3 billion in reported business email compromise losses in 2025 — roughly $123,000 per incident — and 86% of it moved by wire or ACH, where the recovery window is measured in hours. The attacker doesn't need to hack anything. They need one person, covering someone else's job, for one week.

Three things to do before your next week off

Trim what outsiders see. Keep the detailed auto-reply — dates, backup contact — for coworkers only. Microsoft 365 lets you set a separate reply for external senders: "I'm out of the office and will respond when I return." No dates, no names, no numbers. Ten minutes per mailbox in Outlook's automatic-replies settings.

Make the callback rule vacation-proof. Any change to bank details and any "urgent" payment request gets a voice call to a number you already had on file — and the rule holds especially when the requester is away. "I couldn't reach them" means the payment waits, not that it goes through. Say this out loud to the team before people start leaving; the rule only works if everyone knows it has no exceptions.

Brief whoever's covering. The stand-in is the target, not just the substitute. One sentence in the handoff: if a message about money, passwords, or vacation dates feels even slightly off, confirm it through a separate channel — a phone call, a Teams message, a walk across the office — before clicking or paying.

One more thing worth knowing: whether your auto-replies go to outside senders at all is a setting in your Microsoft 365 admin center, not just in each person's Outlook — one of those defaults most businesses have never looked at. It's the kind of thing Tenant Strike's read-only scan checks, along with 100+ other settings, before grading your setup A–F with the exact fix for each. But the callback rule costs nothing, takes one announcement, and works from any beach.