October 27, 2026

Nobody thinks of an out-of-office reply as a security setting. It's a courtesy. You're being helpful, telling people when you'll be back and who can help in the meantime.

Now read it the way a scammer does.

"I'm in Cancun with my family until the 30th with no phone access. For anything urgent, including wire approvals, contact Dave at 610-555-0142."

That one message tells a stranger: the boss is out of the country, for exactly how long, can't be reached to verify anything, and Dave is the person who moves money while she's gone. Here's his number. Every scam we've written about since August, the fake boss text, the cloned voice call, the vendor bank change, works better with exactly this information. And the out-of-office reply sends it automatically to anyone who emails you, including the people fishing for it.

The Good Version

An away message needs to do two things: say you're away, and say when you'll respond. Everything else is optional, and most of it is a gift to the wrong people.

• Bad: "I'm at a conference in Las Vegas through Friday and checking email sporadically. For urgent payment questions contact Maria in accounting."
• Good: "I'm out of the office and will reply when I return on Monday. For urgent matters, please call our main line."

Notice the good version still helps a real customer. It just doesn't explain where you are, that you can't verify things, or which specific person handles money. Route urgency through your main number, where a human can decide what's actually urgent.

Social Media Runs the Same Play

"Two weeks in Italy, see you all in November!" is the out-of-office reply with the audience set to everyone on earth. The vacation countdown, the airport selfie, the "finally on the beach" post: each one tells anyone watching that you're gone, unreachable, and likely to be distracted. Post the photos when you're home. They'll get the same likes.

New job posts deserve special care. "Thrilled to join Acme as the new accounts payable specialist!" tells a scammer three useful things: you're new, you don't know the company's habits yet, and you're the person who pays invoices. That's the exact profile the fake-boss and fake-vendor scams target. Announce the job after you've started, and keep the description general.

A Two-Minute LinkedIn Checkup

• Does your profile list the specific systems you use, the vendors you manage, or the exact money processes you own? That's research material. Keep it to what you do, not how.
• Is your work email or direct phone number visible to the public? Move it to connections-only.
• Are you accepting every connection request? Scammers build fake profiles specifically to see what's behind the connections-only wall. Look at a request for ten seconds before accepting.

Owners: Take the Target Off Individual People

If your out-of-office replies have to name who approves money, the real problem is that one person approves money. Set up a simple rule instead: any payment or banking change requires two people, every time, regardless of who's in the building. Then nobody's away message needs to broadcast the backup, because the process is the backup. It's also the single policy that makes most of the scams we've covered this year fail on contact.

That's four weeks of Cybersecurity Awareness Month: install the update, check the To line, bring your own network, and stop handing out the details. Four small habits your team can keep forever, and none of them required a single piece of jargon. That's what No Geek-Speak means to us.

Want to see how your team would do against a realistic phishing email after all this practice? We run friendly simulations that show exactly where practice is needed, with zero shaming. Book 20 minutes with me here and let's find out together.

Big U Computers, LLC. Personal Service, Peace of Mind, No Geek-Speak, and We Won't Hold You Hostage. That's the promise.