Fraudsters love the holidays. Phishing, gift-card scams, payment redirects, and credential-stuffing spike when your team is slammed. A general liability policy won’t cover a wire transfer tricked by a spoofed email, and many cyber policies bury social-engineering and funds-transfer fraud under tiny sublimits.
What goes wrong:
- No social-engineering endorsement (or a sublimit too small to matter).
- Incomplete business interruption coverage for system outages after ransomware.
- Weak MFA on email and accounting logins, just as invoice volume explodes.
Smart fix:
Confirm your cyber policy has meaningful limits for social engineering, computer fraud, and funds-transfer fraud, plus data restoration and business interruption. Ask your agent to review your incident-response panel (forensics, legal, PR) and make sure contact info is current. Then put simple controls in place: mandatory MFA, payment-change verification by phone, and a two-minute “holiday phishing” refresher for the team. Ignoring cyber is one of those business insurance mistakes that doesn’t show up—until it does, expensively.