Returning from vacation means opening the computer, catching up on meetings, reviewing dozens of accumulated emails, and getting up to speed with matters that were left pending before summer. But that need to rapidly regain the pace of work can also become an opportunity for cybercriminals.
The latest official data also show that the threat continues to grow. The National Institute of Cybersecurity (INCIBE) managed 122,223 cybersecurity incidents in Spain during 2025, up 26% from the previous year. Online fraud accounted for four out of ten incidents, with 45,445 cases, 19% more than in 2024, while phishing reached 25,133 cases. Additionally, 3,849 incidents related to unauthorized access to or theft of digital or confidential information were recorded.
In the corporate sphere, data from the Cybersecurity Help Line 017 also reflect the weight of social engineering. Impersonation by spoofing accounted for 18% of inquiries made by companies, followed by phishing (12%) and CEO fraud (9%).
In this scenario, Qualiteasy Internet Solutions, the exclusive distributor in Spain of Faronics solutions, warns that the return from vacation is a particularly opportune moment to review the digital protection of organizations and strengthen employees’ awareness. During the summer, corporate devices may have connected to public networks, some updates may have been pending and workers return with a high volume of messages to review.
“Cybercriminals do not always need to overcome large technological barriers. Often they simply look for the right moment to get someone to click, enter a password, or authorize a transfer. The post-vacation return brings together several factors that can favor precisely that kind of error,” explains Ignasi Nogués, Chief Growth Officer of Qualiteasy Internet Solutions, exclusive Spain distributor of Faronics solutions.
Scams That Require Extra Caution
Among the most common risks, according to Qualiteasy Internet Solutions, is phishing hidden among accumulated emails. A fake Microsoft 365 notification, a supposed bank statement, a shared document, or a message from a courier company can slip through more easily when the employee rushes to clear their inbox.
Another common scam is the warning that ‘the password expired during the vacation’. The message directs the user to a page that imitates the original service to obtain credentials. Messages on WhatsApp from the supposed boss who claims to have ‘changed number’ and ends up requesting an urgent transfer, as well as invoices that apparently remained outstanding before the summer, should also raise suspicion.
Particularly sensitive are unexpected changes to suppliers’ bank accounts. Frauds known as Business Email Compromise (BEC) can use real information about suppliers, employees or previous invoices to ensure that a transfer ends up in an attacker-controlled account.
In addition, there are fake shared documents that lead to fraudulent login pages and unexpected requests for multifactor authentication (MFA). In this latter case, Qualiteasy Internet Solutions recommends never approving an access request that the user did not initiate themselves and to report the incident immediately to the appropriate official.
“When faced with any request related to money, passwords, or confidential information, spending thirty seconds to verify it can prevent a major problem. If there is a bank account change or an unexpected financial request, the prudent move is to verify it always through a second channel we already know,” says Ignasi Nogués.
