Year-End Phishing and AI: What Changed in 2025, and What to Check

Updated October 2026 to our current guidance. The original reporting date is unchanged.

Every year, the last three months bring a wave of scam emails timed to year-end business. In 2025 the wave looked different, because AI was writing more of it. The emails got cleaner and more personal. Here is what that means and what to check.

Why the end of the year draws scams

You already know this season. Invoices speed up, tax forms go out, bonuses and benefits change, and people take time off. Scammers time their emails to match:

• Year-end reconciliations and invoice runs fill inboxes.
• Payment approvals move faster and get less scrutiny.
• Holiday coverage means temporary staff handle requests they have not seen before.
• New vendors get set up in a hurry.
• Software updates get put off until January.

None of that is carelessness. It is a busy season, and scams are built to fit busy seasons.

What AI changed

The old warning signs were spelling mistakes, “Dear Customer,” and odd formatting. Those mostly disappeared. AI-written scam emails now tend to have:

• clean grammar and a tone that matches your company’s,
• details pulled from LinkedIn, your website, or old data leaks,
• timing that matches real events on your calendar.

Criminals use tools like ChatGPT to write the emails, test which versions get clicked, and translate them into any language. Some follow up with a phone call in a cloned voice.

The themes to watch for

These were the common year-end lures in 2025:

1. Bonus notices: “Confirm your details for your bonus payment.”
2. Tax form requests: “W-2 correction required.”
3. Holiday giving: “The CEO’s annual giving campaign.”
4. Vendor payment changes: “Update our banking details before year-end close.”
5. Benefits enrollment: “Open enrollment closes today.”

Three tactics showed up more often too:

• QR codes in the email instead of a link. They slip past filters that read links, and they are harder to inspect on a phone.
• Callback scams. The email has a phone number, not a link, and a real person on the other end builds trust.
• Hijacked threads. The criminal replies inside a real email conversation taken from a compromised mailbox, so the context looks right.

What still works

Check payments and access a second way

• Confirm any wire transfer above a set amount by phone, using a number you already have.
• Wait a day before paying a new payee.
• Require two approvals for any change to a vendor’s bank details.
• Remove access people no longer need, and give contractors access that expires.

Set up your email properly

Ask whoever runs your email whether SPF, DKIM, and DMARC are set up. These are the settings that let other mail servers check that a message really came from your domain. Block newly registered domains if your filter allows it. Require two-step sign-in for every account that can change money or settings.

Make reporting easy

Thank people who report a suspicious email, even when it turns out to be real. Share near-misses without blame. Run a practice phishing test now and then, and use it to teach, not to catch people out.

Keep your software current

Windows Update never touches third-party software.

It keeps Windows current. It does not update the PDF reader, the file compression tool, the remote-access program, or the specialty app your office runs on. Nobody did anything wrong. That is where its job ends. A scam email often needs only one out-of-date program to get from a click to a foothold.

So who has been checking those programs on your computers?

Who will ask you to prove it

Has anyone asked you to prove your security lately: an insurer, a client, an auditor? Year-end is when many of those requests arrive.

• Cyber insurance renewals now commonly ask whether two-step sign-in is on, whether staff are trained, and whether you have a tested response plan.
• A bigger customer may send a security questionnaire with the contract. Since December 2023, the SEC has required public companies to disclose a material cybersecurity incident within four business days of deciding it is material, so public companies have reason to ask their suppliers more questions.

A dated record of what you have checked makes those forms much easier to answer.

If something gets through

First two hours

• Disconnect the affected computer from the network.
• Reset the passwords that may have been exposed.
• Keep the evidence. Do not wipe the machine yet.

First day

• Work out which accounts and data were reached.
• Check the logs for signs it spread to other machines.

First two days

• Call your lawyer and your insurer.
• Bring in incident response help if you need it.
• Work out who has to be told, and draft what you will say.

A one-week checklist

• Monday: send staff a short year-end reminder and review how payments get approved.
• Tuesday: test a restore from backup.
• Wednesday: check that two-step sign-in is on everywhere it should be.
• Thursday: review who has access to what.
• Friday: walk through what you would do if someone clicked.

Count what is on your own computers

Before you look, guess how many programs are installed on the computer in front of you. Write it down. Then run the Reveal Scan. It counts what is installed on each Windows PC: how many programs are current and how many need updating. The second number is usually higher than people expect. You don’t have to be able to do this. We’ll do it with you.

Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.

If you run it and never speak to us again, that’s a fine outcome.