New Year’s Resolutions for Cybercriminals (Spoiler: Your Business Is on Their List)
The 10-Second Overview
Cybercriminals start the year with a plan—and small businesses are at the top of their list. This article breaks down their most common “New Year’s resolutions” for 2026 and shows how smart, practical cybersecurity steps can stop attacks before they start.
Somewhere right now, a cybercriminal is setting New Year’s resolutions too.
They’re not staring at a vision board about self-care or work-life balance.They’re reviewing what worked in 2025 and planning how to steal more in 2026.
And guess what? Small businesses are their favorite target.
Not because you’re careless. Because you’re busy.
And criminals love busy.
Here’s their 2026 game plan—and how to ruin it.
Resolution #1: “I Will Send Phishing Emails That Don’t Look Fake Anymore”
The era of laughably bad scam emails is over.
Today’s phishing attacks use AI to create messages that:
Sound completely normal
Match your company’s tone and language
Reference real vendors you actually work with
Avoid obvious red flags
They don’t need typos anymore. They just need timing.
January is perfect timing—people are distracted, moving fast, and catching up from the holidays.
What a Modern Phishing Email Looks Like
Hi [your actual name], I tried to send the updated invoice, but the file bounced back. Can you confirm this is still the right email for accounting? Here’s the new version—let me know if you have questions. Thanks, [name of your actual vendor]
No Nigerian prince. No urgent wire transfer. Just a normal-sounding request from someone you recognize.
Your Counter-Move
Train your team to verify, not just read. Any request involving money or credentials should be confirmed through a second channel.
Use advanced email filtering that detects impersonation attempts, not just spam.
Create a culture where questioning is praised. “I verified before responding” should be celebrated—not treated as paranoia.
Learn more about modern phishing techniques from the FTC’s phishing guidance.
Resolution #2: “I Will Impersonate Your Vendors… or Your Boss”
This one is brutal because it feels so real.
A vendor email arrives:
We’ve updated our bank details. Please use this new account for future payments.
Or a text hits your bookkeeper:
Urgent. Wire this now. I’m in a meeting and can’t talk.
Sometimes it’s not even text anymore.
Deepfake voice scams are rising. Criminals clone voices from podcasts, YouTube videos, and even voicemail greetings. The “CEO” calls finance and asks for a quick favor—and it sounds exactly like them.
That’s not science fiction. That’s Tuesday.
Your Counter-Move
Establish a callback policy for any bank account or payment changes using known phone numbers.
Require voice confirmation through established channels for all payment changes.
Enable multi-factor authentication (MFA) on all finance and administrative accounts.
If MFA isn’t everywhere yet, that’s a gap worth closing immediately. Our guide to Managed IT Services explains how these protections work together.
Resolution #3: “I Will Target Small Businesses Harder Than Ever”
Big companies used to be the main targets. Now? Not so much.
Enterprise security improved. Insurance requirements tightened. Large organizations became harder—and more expensive—to attack.
So criminals pivoted.
Why attempt one risky $5 million attack when you can run a hundred $50,000 attacks that usually succeed?
Small businesses are now the primary target because:
You’re understaffed
You don’t have a dedicated security team
You’re juggling everything
You assume “we’re too small to be worth it”
That belief is their favorite vulnerability.
Your Counter-Move
Stop being low-hanging fruit. MFA, patching, and tested backups make you harder to attack than the business next door.
Delete “we’re too small to be a target” from your vocabulary. You’re not too small—you’re just too small to make headlines.
Get professional help. You don’t need enterprise security; you need the right partner.
Resolution #4: “I Will Exploit New Employee Season and Tax Chaos”
January brings new hires—and new hires don’t know your rules yet.
They want to help. They want to impress. They’re less likely to question authority.
From an attacker’s perspective? Perfect.
Then tax season hits.
Common scams include:
Fake W-2 requests
Payroll phishing
Impersonated IRS notices
One email pretending to be your CEO or HR director can expose every employee’s Social Security number in minutes.
Your Counter-Move
Include security training in onboarding BEFORE email access is granted.
Create written policies like “We never send W-2s via email” and “All payment requests must be verified.”
Reward verification. The employee who double-checks should be praised, not rushed.
The IRS outlines common tax scams here: https://www.irs.gov/newsroom/tax-scams-consumer-alerts
Preventable Beats Recoverable. Every Time.
You have two choices with cybersecurity:
Option A: React after the attack. Pay the ransom. Hire emergency help. Notify customers. Repair systems and reputation.
Cost: Tens or hundreds of thousands.
Outcome: You might recover—but you’ll never forget it.
Option B: Prevent the attack. Implement proper security. Train your team. Monitor continuously.
Cost: A fraction of Option A.
Outcome: Nothing happens—which is the goal.
You don’t buy a fire extinguisher after the building burns.
How to Ruin Their Year
A good IT partner keeps you off the “easy target” list by:
Monitoring systems 24/7
Locking down access and credentials
Training your team on modern scams
Enforcing verification policies
Maintaining and testing backups
Patching systems before criminals exploit them
Fire prevention—not firefighting.
Take Your Business Off Their Target List
Cybercriminals are optimistic about 2026.They’re counting on businesses being busy, understaffed, and unprepared.
Let’s disappoint them.
Book a New Year Security Reality Check. We’ll show you where you’re exposed, what matters most, and how to stop being low-hanging fruit.
No scare tactics. No jargon. Just clarity.
Because the best New Year’s resolution is making sure you’re not on someone else’s list of goals.
FAQs
Q1. Why are small businesses targeted more than large companies?
Because they often lack dedicated security teams and rely on trust-based workflows that are easy to exploit.
Q2. Is phishing really getting worse?
Yes. AI-driven phishing is more convincing, better timed, and harder to spot than ever.
Q3. What’s the most effective first security step?
Multi-factor authentication combined with employee training eliminates a huge percentage of attacks.
Q4. Do I need full-time IT staff for cybersecurity?
No. Most small businesses benefit more from a managed IT partner than hiring in-house.
About the Author
Victor Parrish has spent more than three decades helping business owners use technology to improve security, efficiency, and day-to-day operations. As part of the team at We Do IT USA, Victor partners with small businesses to deliver straightforward, practical guidance that makes technology reliable, scalable, and stress-free.
Victor believes technology should help you grow — not hold you back.
Comments