An out-of-office reply is such a routine, low-stakes piece of email admin that it rarely gets a second thought — but a well-meaning, overly detailed one can quietly hand a scammer useful information, particularly over the Christmas period when so many of them are set at once.
What an over-detailed one actually gives away
A reply stating "I'm away until 5th January, please contact my colleague Sarah at sarah@company.co.uk for anything urgent, or call the office directly on [number]" is friendly and well-intentioned, but it also confirms you're genuinely unreachable for a specific window, names exactly who to approach instead, and gives a scammer a real colleague's name and email to reference convincingly in a follow-up message impersonating either of you.
Why this matters more than it sounds like it should
A very common scam pattern involves an email impersonating a colleague or manager, asking for an urgent payment or sensitive information while that person is known to be away or hard to reach. An automatic reply that confirms exactly when someone's unreachable, and names exactly who's covering for them, makes that specific scam considerably easier to pull off convincingly.
A better way to phrase it
Keep it genuinely useful to real contacts without over-explaining to anyone else reading it: "I'm currently out of office with limited access to email. For anything urgent, please contact [team email address or main office number] and someone will assist you." This gives a legitimate sender what they need, without confirming specific dates or naming a specific individual to target instead.
Avoid exact return dates where you can
Where it's practical, a vaguer "back in early January" causes less harm if it does get seen by the wrong person than a precise "back on the 5th," which gives a very exact window during which impersonation attempts are least likely to be caught.
Remind staff this applies to them too, not just the business inbox
This is worth mentioning to the whole team before the Christmas break, not just applying to a main company account — individual staff automatic replies carry exactly the same risk, and tend to get set up quickly and without much thought right before everyone leaves for the holidays.
If you'd like help reviewing this and other small but overlooked security gaps before the holidays, our cyber security page covers how we can help, or get in touch.
Talk to a local IT team
Get in touch and we'll talk you through how we can help — no pressure, no jargon.