Your 'Closed Until 4 January' Note Is a Scammer's Diary Entry

Most of us treat the out-of-office message like a sticky note on the front door: polite, temporary and not worth a second thought. In the run-up to Christmas 2026, that note is worth a second look. A festive auto-reply is a small piece of public-facing information. It tells anyone who emails you — including someone who has scraped your address from a quote, a directory listing or a leaked database — when you are away and when you are back. For a household, that is mildly annoying. For a micro-firm, it can be the missing piece in a convincing invoice or impersonation scam.

The quiet value of knowing you're out

Fraudsters do not need to break into your inbox to learn something useful. They need a timeline. If your reply says 'I'm away from 23 December and back on 5 January', they know when a payment run is thin, when a supplier query will sit unanswered, and when a junior colleague might be covering. That is not paranoia; it is how invoice diversion and impersonation fraud often work. The scam email arrives just before a shutdown, when a real supplier invoice is expected but nobody is around to check bank details by phone. The fraudster only needs one person to think: 'I'll sort it when [name] is back.'

The same logic applies at home. A shared household email address with a festive auto-reply can reveal when the house is empty, when a parcel is due, or when a family member is unlikely to spot a fake delivery notice. It is not about scaring you into silence. It is about giving away less than you need to.

Three details that do the most damage

1. Exact dates. 'Closed from 22 December to 4 January' is a diary entry for someone else. It tells a fraudster precisely when your guard is down and when normal checks resume.

2. Job titles and named contacts. 'For urgent invoices, contact Sarah in finance' is helpful to your team. It is also a map for someone pretending to be a supplier, a bank or a director. They can use Sarah's name, your job title and the urgency of the season to sound plausible.

3. Supplier or client clues. Phrases such as 'I'll respond to outstanding supplier queries in the new year' or 'for matters relating to the Smith contract' confirm who you work with and what is live. That is useful context for a targeted phishing email.

A 15-minute rewrite for homes and micro-firms

You do not need to turn your auto-reply into a riddle. You need to remove the details that help someone else plan. Try this checklist before you switch it on.

1. Open every auto-reply you own. Work email, personal email, shared household inbox, volunteer group address, and any info@ or sales@ address for a small firm. Old auto-replies have a habit of surviving longer than intended.

2. Replace exact dates with a window. 'I'll be checking email less often over the festive period and will reply in the week beginning 5 January 2027' is still useful without advertising every empty day.

3. Drop the travel detail. 'I'm travelling' or 'I'm away from the office' is not necessary. 'Our office is closed over the Christmas period' does the job.

4. Use a team route, not a personal one. If urgent matters must be covered, point to a monitored shared inbox or the main office number rather than a named colleague's mobile. Avoid giving a direct line to someone who is also on leave.

5. Do not name suppliers, clients or projects. Keep the message generic. The person who legitimately needs that information probably already knows it.

6. Add a simple fraud warning. A line such as 'If you receive a request to change our bank details, please call the number published on our website rather than replying to this email' is short, sensible and useful all year round.

7. Check the voicemail greeting too. If your phone message says you are away until a precise date, apply the same logic. The goal is consistency, not secrecy.

Safer wording to borrow

For a small firm, something like this is usually enough:

Thank you for your email. Our office is closed over the festive period and will reopen in the week beginning 5 January 2027. Messages will be checked periodically. If your query concerns a payment or a change to bank details, please call the number published on our website rather than replying to this email.

For a household or volunteer inbox, keep it even simpler:

Thanks for your message. I'm not checking email regularly until early January. For anything urgent, please call. I won't send or confirm bank details by email.

Test it before you switch it on

Send a test message from another account and read the reply on your phone. Check that it does not include a calendar attachment, a signature with your direct mobile number, or an old line about 'urgent supplier invoices'. If your email system lets you set different replies for internal and external senders, use it. Colleagues can have the useful detail; everyone else can have the short version.

Finally, tell the people who cover for you. A safe auto-reply is no good if the person picking up the inbox does not know the payment checks are meant to continue. A quick note in the team chat before the shutdown is worth more than a cleverly worded message.

The point is not to be vague for the sake of it. It is to be deliberate about what your festive message gives away. A good out-of-office should tell genuine contacts when to expect a reply. It should not tell a stranger when to strike.