The out-of-office reply is polite, sensible and, written the usual way, a small briefing for a fraudster. “I am away until the 19th, for anything urgent contact Sarah in accounts, sarah@…” tells a stranger three useful things at once: that you are not there to notice, who now handles the money, and how to reach them. Over the summer, when half the team is off and cover is patchy, that is exactly the window attackers wait for.

The scam it feeds is invoice and mandate fraud. Knowing you are away, someone emails Sarah posing as you or as a supplier, says a payment is urgent and the bank details have changed, and leans on the fact that the person who would normally check is unreachable. The out-of-office did not cause the fraud, but it supplied the timing, the target and the pretext, which is most of the work done for them.

You do not need to switch the out-of-office off, because a real supplier needing paying should not be left in silence. You need to say less. Give a date and a general team address rather than naming who handles finance and how to reach them directly. The people who genuinely need Sarah already know how to find her. The stranger drafting a fake invoice should have to work for it.

The stronger protection is the one that does not depend on wording at all. Agree before the holidays that any change to payment details, or any urgent unexpected payment, gets verified by a phone call to a known number, no matter who appears to be asking or how senior they sound. Tell the team that “the boss is on a beach and said it's urgent” is precisely when to slow down, not speed up.