Cybersecurity habits slip over the holidays. Your advisors and operations staff haven’t stopped caring about protecting client data. They’re just working differently in December, and so is everyone else at the firm.
Year-end is already one of the busiest stretches for an advisory firm. RMDs, year-end distributions and contributions, tax-loss harvesting, billing, client reviews and staff PTO all land in the same few weeks. That’s exactly the environment attackers count on.
Before travel and PTO plans are locked in, take a few minutes for a short security reset with your team, framed around year-end availability and workflows. “Don’t forget your security training” won’t cut it. Reframing a few core habits around what your team will actually face this season keeps leadership, advisors and staff sharp, and keeps your firm aligned with its obligations to protect client information under Regulation S-P.
1. Slow down when something wants you to hurry
Urgency is a scammer’s favorite tool, and it rarely works better than during the year-end rush. With advisors and operations staff racing to process distributions and wrap up client work before the holidays, an urgent request doesn’t look out of place.
- “Can you get this wire out before you leave today?”
- “I need this distribution processed by end of day so it clears before the new year.”
- “I’ll be traveling and unreachable for a few days. Please update my bank details and send the funds.”
When everything already feels urgent, a fraudulent request blends right in. Just like the rest of the year, manufactured urgency is designed to override your skepticism and get you to act on instinct, especially when money is moving.
The more pressure there is to hurry, the more reason to stop and confirm the request through your firm’s normal verification process.
2. Verify the “quick favor”
Advisory staff want to be responsive, and clients expect it. That instinct is a strength, but it’s also exactly what business email compromise and impersonation scams exploit. Client service associates, operations staff and anyone handling custodian paperwork are prime targets.
Any request to move money, change banking or account details, update contact information or share nonpublic personal information (NPI) must be verified, no matter how familiar the sender seems.
- If the request comes from a client, call them back at the phone number already on file, never a number supplied in the email or text.
- If it appears to come from a colleague or another advisor, confirm by phone or another trusted channel.
- If you can’t reach the person, follow your firm’s written procedures instead of improvising, including any callback requirements for third-party wires and changes to standing instructions.
Taking an extra minute to verify will always beat getting a wire out a minute faster, especially when the alternative is a client loss, an uncomfortable call with your custodian and a possible incident response under Reg S-P.
3. Don’t let convenience take over when you travel
The risks tied to personal devices, unapproved apps and public Wi-Fi all rise over the holidays and other travel-heavy times of year.
Hotels, airports and coffee shops introduce real risk. Advisors shouldn’t be discouraged from working on the road, but they do need to connect the way firm policy requires, such as through the firm’s VPN or a trusted hotspot rather than open public Wi-Fi.
Personal devices raise similar concerns while staff are away. Be clear about what can and can’t be accessed from a personal phone or laptop so client NPI stays on firm-managed devices.
Even with the right device on the right network, shadow IT is a concern. Shadow IT is any tool used for firm business that the firm hasn’t approved, and for advisers that includes texting clients from a personal phone or using a messaging app the firm doesn’t archive. Beyond the security risk, off-channel communications can create a books-and-records problem under the SEC’s recordkeeping rule, a recurring focus of SEC exams and enforcement in recent years. Before everyone scatters, remind the team which tools are approved for which tasks, and which ones are archived.
None of this is meant to penalize travel or time off. These policies exist to account for how advisory firms really work during the holidays and to build habits around it.
4. Think before you click the holiday bait
Good morning! You pick up your phone and see everything that landed overnight.
- Shipping update: Your gift is arriving soon
- Action required: Review and sign your year-end documents
- Security alert from your custodian: Unusual sign-in detected
- For being a valued customer, here’s 20% off your next visit
In all that noise, you might not notice you never ordered anything, or that nobody sent you documents to sign.
Even when it’s a message you’re expecting, personal or professional, check the sender and links before acting. Better yet, go directly to the custodian platform, client portal or retailer you already know instead of following the link in the email.
Phishing works because people never stop to consider that something might be off. Credential phishing aimed at email, CRM and custodian logins remains one of the most common ways client NPI ends up exposed.
5. Know who to ask when something feels off
All of these habits come down to one thing: knowing where to turn when something might be a threat. Even the most careful advisor will run into something they aren’t sure how to handle, and when that happens, “try your best” isn’t an answer.
Make sure everyone knows:
- Who to contact when a suspicious email, text or call comes in, including while key people are out of the office
- How to report it, and when your CCO needs to be looped in
- What to do right away if a link was clicked, credentials were entered or a request was already processed
For SEC-registered RIAs, amended Regulation S-P requires written incident response procedures to detect, respond to and recover from unauthorized access to customer information. It also generally requires notifying affected individuals within 30 days of becoming aware that sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. That clock only works in your favor if staff report quickly, so make sure your holiday coverage plan reflects who is actually available.
Responding to an incident is bigger than one employee. It may take coordination between the staff member, your CCO, firm leadership, your IT and security provider, and often your custodian. Knowing when to ask questions and who to ask is at the heart of good cybersecurity hygiene, and it’s the most important piece of this puzzle.
Nobody needs another hour-long training the week before the holidays
Quick reminders go a long way, but pulling advisors away from year-end client work for another hour-long session probably isn’t what your team needs right now.
Instead, keep the message brief, practical and tied to what staff are likely to see this season. Remind them to slow down, verify money movement and account changes, follow firm policy while traveling and know who to call when something doesn’t look right.
Leave the technical details to firm leadership and your IT team.
If your firm’s cybersecurity could use a check-in before holiday travel begins, CyberSecureRIA can help make sure remote access, device policies and incident reporting procedures are ready for the season and aligned with Reg S-P.
Schedule a 45-minute discovery call and let’s take a closer look. Call us at 865-622-9304 or visit our website.
