Before holiday schedules change, give your team a practical security refresher: how to verify sensitive requests, work through approved systems, and get help when something looks wrong. That is more useful than a general reminder to “stay vigilant.”
Picture someone finishing work in Wilmington before heading out of state. A finance employee covering for a colleague. A manager checking messages between appointments. These are ordinary situations, and your security procedures need to be understandable in them, not only when everyone is at their usual desk. A brief reset before people begin taking time off makes expectations clear.
Cover these five things:
- Pause when a request tries to rush you
- Verify sensitive requests through a trusted channel
- Make the travel rules easy to follow
- Check delivery notices without following surprise links
- Make reporting instructions unmistakable
1. Why should employees pause when a request tries to rush them?
An urgent message can look ordinary when you are trying to finish several things before leaving.
“Please handle this payment before you sign off.”
“I’m away tomorrow. Can you send the information now?”
Scammers use urgency to keep people from checking a request before acting. The Federal Trade Commission lists a sense of urgency, intimidation, and fear among common scammer tactics and advises that no one should rush you to pay or to share sensitive business information.
Treat urgency as a reason to follow the process carefully, not as permission to skip it. A useful message from leadership is simple: taking time to verify a sensitive request is part of doing the job properly.
2. How should employees verify sensitive requests?
A familiar name is not enough to establish that a request is legitimate. The FBI advises checking the sender’s email address closely, because business email scams can use addresses that look nearly identical to a real one. The FTC also advises training employees not to send passwords or sensitive information by email, even when the message appears to come from a manager.
Requests to change payment details, send sensitive information, or bypass an approval deserve independent verification. Call the person using a number already in your records. Don’t rely on a new number supplied in the message you are trying to check. The FBI recommends verifying changes through the contact on file, not the number in the email.
Before holiday absences begin, identify the backup approver. Nobody should have to choose between guessing and interrupting someone’s vacation because the process stops with one person. For more on why a clear verification process matters, read Think Cybersecurity Is Just IT’s Job? The Real Issue Is Knowing What Happens Next.
3. What travel and remote work rules should employees know?
Whether someone is working from home, a hotel, or another office, they should know which devices, applications, and connection methods the company permits. Review those expectations before travel begins.
Start with your organization’s policies and the connection method it provides, such as a company VPN. Translate that into instructions your employees can use:
- Which device should they take?
- Which business systems may they access from a personal device, if any?
- Where should company files be stored?
- What should they do when the approved connection isn’t working?
Make the approved route clear, and explain how to get help. A personal email account or an unapproved file-sharing app should not become the improvised fix for an access problem. The aim is to support people working in different places, not to make them work out security policy while standing in an airport.
4. How can employees check a delivery notice safely?
Holiday orders make fake shipping messages believable. A message may claim that a package cannot be delivered until you update an address or resolve a payment issue. The FTC warns that these messages can lead to look-alike websites designed to collect personal or financial information.
Instead of following the link, open the retailer’s or shipping company’s known website or app yourself and check the actual order there. This applies to business purchases and personal deliveries alike. An expected package does not make every message about it trustworthy.
5. Who should employees tell when something looks wrong?
“Tell someone” is not a complete reporting process. Before people take time off, confirm the normal reporting channel, the backup contact, and the escalation steps for urgent concerns.
Employees should know what to do when they receive a suspicious message, and when they have already clicked a link or shared information. Employees should contact the organization’s help desk or security team when unusual or suspicious activity appears on a device used for work. Encourage people to report promptly rather than waiting until they are certain something is wrong. They do not need to investigate it themselves.
For existing Diamond clients, our Support Center lists 302-656-6050 for phone support during business hours and support@diamondtechnologies.com for email ticket submission. Confirm your organization’s agreed holiday and after-hours escalation arrangements before staff begin taking leave.
Support the people behind the policies
A holiday refresher should reinforce ongoing training and technical protections, not replace them. Keep it focused on a few realistic situations and clear next steps, and make asking for help an expected part of the process.
Diamond Technologies has served businesses across Delaware, Pennsylvania, Maryland, and New Jersey from Wilmington, Delaware since 1996. Our cybersecurity services include employee security awareness and protection for business networks and devices. We work with staff on recognizing concerns and knowing what to do next. As you review holiday coverage, consider whether your team has the guidance it needs to work confidently wherever the season takes them.
Schedule a discovery call with Diamond Technologies. Call 302-656-6050 to discuss your security priorities, or contact us online.
Frequently Asked Questions
What cybersecurity steps should employees take before the holidays?
Review five things before staff take leave: how to verify urgent or sensitive requests, who the backup approver is, which devices and systems are approved for travel, how to check delivery notices without following links, and how to report suspicious activity, including who to contact if someone already clicked.
How can employees verify a payment or account change request?
Contact the person using a phone number already in your records, not a number supplied in the message. The FBI advises verifying changes through the contact on file. Requests to change payment details, send sensitive information, or bypass an approval deserve independent verification.
Why do scammers create urgency?
Urgency keeps people from checking a request before acting. The FTC lists a sense of urgency, intimidation, and fear among common scammer tactics. A request that pressures you to act before you leave for the day is a reason to slow down and follow your verification process.
How can you tell if a delivery notice is fake?
You often can’t tell from the message alone. The FTC warns that fake delivery messages can lead to look-alike websites that collect personal or financial information. Don’t follow the link. Open the retailer’s or shipping company’s known website or app yourself and check the order there.
What should an employee do after clicking a suspicious link?
Report it right away to your organization’s help desk or security team, even if you are not sure anything is wrong. You do not need to investigate it yourself. Diamond clients can reach the Support Center by phone at 302-656-6050 during business hours or by email at support@diamondtechnologies.com to open a ticket.