Some crooks never write a clever email. They don’t need to.
They just keep a calendar.
Picture him in a small flat above a chip shop, a wall diary open in front of him, a red pen behind his ear. He isn’t studying you. He is studying November.
Priya in payroll knows none of this. She only knows that an email has landed with the subject “2026 Compensation Adjustment Letter,” and that her stomach is doing the small, hopeful flip it does every year at this time. There is a QR code. Scan to view your letter. It is hard not to.
Next week the very same letter lands in the inbox of a man in a haulage firm and a woman in a dental practice. Only three things have changed: the company name, the recipient, and the QR code. That is the whole of his effort. The calendar did the rest.
The true bit
This week, Netcraft researchers caught one at it: fake salary letters, fake Q4 invoices and fake “access reviews,” sent to company after company. Most never mentioned the year end. The calendar did that for them. One letter, a “2026 Compensation Adjustment Letter,” went out again and again, with only the company name, the recipient and the QR code changed.
Two things to know
- He borrows your urgency. Your diary already has a deadline in it, so he doesn’t need to invent one.
- He likes being predictable. Everyone knows what arrives in November, so one template fits every inbox.
Five dates he has circled
- Bonus season. “Your salary letter is ready. Scan here.” Hard to ignore.
- Year-end invoices. Finance is buried, and one more “final Q4 statement” slips through.
- Access reviews. “Confirm your permissions or lose access.” It sounds like IT housekeeping.
- Tax deadlines. Near Revenue’s pay-and-file date, a “refund due” email looks entirely normal.
- Christmas. Bosses are away and out-of-office replies say exactly who is missing. “Urgent payment. Your manager can’t be reached.”
How to spoil his plans
- Decide now how pay, invoices and access reviews will reach people, and tell them.
- Treat anything arriving another way as suspect.
- Brief teams on this month’s tricks, not on phishing in general.
- Before Christmas, name who can approve payments while key people are off.
The Calendar Crook reads the calendar carefully.
So should you.
References
- Netcraft, Year-end phishing lures (link to be added before publishing).
- Netcraft, “Quishing” you a happy holiday season (background on QR-code phishing).
- Mimecast, HR bonus-themed QR code phishing campaign exploiting year-end corporate processes.
- National Cyber Security Centre Ireland, Quick guide: QR code phishing scams.