As online shoppers around the world gear up for the excitement, bargains, and rush of Black Friday 2025, cybersecurity researchers are raising serious concerns that this year could be one of the most dangerous in shopping-fraud history. The warning comes as experts identify a perfect storm of conditions — surging transaction volumes, increasingly advanced attacker tools such as generative AI and deepfakes, and the consumer urgency and distraction that often accompany the holiday shopping frenzy.
Recent data paints a concerning picture of just how widespread and sophisticated Black Friday–related cyber threats have become. Fraud-monitoring firm Darktrace observed a staggering 692% increase in attempted Black-Friday-themed phishing attacks during the week of November 25–29, 2024, compared to early November. Similarly, Kaspersky reported that its systems blocked over 38.4 million phishing attempts targeting online shopping platforms, payment systems, and banks throughout 2024 — an increase of nearly 25% year on year, according to data cited by IT News Africa.
Fake Black-Friday-themed websites surged by approximately 89% year on year, underscoring how cybercriminals are rapidly scaling operations to deceive consumers. Meanwhile, the UK’s Action Fraud service revealed that between April 2024 and April 2025, there were 784 reports of “quishing” (QR-code phishing) scams, resulting in nearly £3.5 million in losses. Complementing that, a PR Newswire survey found that 74% of U.S. consumers expect to scan at least one QR code during Black Friday or Cyber Monday campaigns a clear signal that this attack vector is ripe for exploitation.
Collectively, these figures highlight how cyber-fraudsters are becoming increasingly adept at leveraging the holiday shopping rush to exploit unsuspecting consumers.
Top 10 Scam Types to Watch During Black Friday 2025
Below are ten scam categories cyber-professionals and consumers alike should watch. For each I include the core methodology, tactics, red-flags to watch, and a brief example of how it plays out.
1. Fake Shopping Websites & Look-alike Domains
Attackers clone or mimic major retail websites, register domain names that look almost identical (e.g., missing letters, extra characters, alternate TLDs), upload convincing product photos, and accept payment or capture credentials.
Fast-domain registration, generative content, realistic checkout flows that terminate after payment. One report tracked an ~89% surge in such sites ahead of Black Friday. (Technuter)
Misspelled URLs, TLDs you don’t expect, no “About Us” or contact info, unrealistic discounts (e.g., luxury item at extreme cut).
Shoppers rushing for a deal may not inspect the URL or check authenticity of a site before entering payment details.
2. Phishing & Smishing
Fraudulent emails or SMS texts that impersonate a retailer, delivery firm, bank or payment service, often referencing Black Friday deals or order re-verification. Victims click a link or open an attachment, and credentials and/or financial data are harvested.
Urgent language (“only 10 minutes left”), use of brand names, link redirection to look-alike domains. Kaspersky data show 44% of online-shopping phishing attacks targeted banking services in 2024. (securelist.com)
Generic greetings (“Dear Customer”), mismatched sender domain, urgent deadlines, offers you didn’t request, out-of-context delivery notifications.
High volume of emails during peak shopping means victims may be less suspicious, and attackers exploit social-engineering triggers.
3. QR Code Fraud (“Quishing”)
Attackers present QR codes (via emails, posters, social media, even physical stickers) that redirect to phishing sites or trigger malware installation. Codes may be overlayed on legitimate ones in public spaces.
Placement in busy retail areas, use in Black Friday campaign signage, mobile users scanning quickly without verifying destination. The Action Fraud stats of ~£3.5 m lost and 784 reports between April 2024–April 2025 reflect the scale. (Action Fraud) Also, reports indicate QR scams now account for ~20% of all online scams. (PYMNTS.com)
QR code in unsolicited message, code stuck over another poster/code, request for login or payment immediately after scanning, no visible brand verification.
QR codes obscure the link destination from the user; when scanning via mobile, many users skip full URL review.
4. AI-Powered Deepfake and Influencer Scams
Attackers use generative AI to create realistic audio/video impersonations of brands, celebrities, or influencers promoting fake Black Friday deals, apps, or “giveaways.” Victims are directed to download fraudulent apps or visit malicious sites.
Synthesis of public-figure appearances, customizing messages to target audience, using deepfake voices to add credibility. While specific quantified data for Black Friday 2025 are still emerging, vendor commentary and academic research point to rising usage of these tools. (arXiv)
Promotional videos on social media from unverified accounts, unrealistic offers tied to a celebrity, links that don’t appear on the official brand’s channels, slight voice or facial movement “offness.”
The novelty and sophistication of the technology lower consumer suspicion—people assume they’re interacting with a genuine brand or influencer endorsement.
5. Fake Social-Media Ads & Counterfeit Marketplace Listings
Fraudsters create fake ads on platforms such as Instagram, Facebook, TikTok, often impersonating established brands, offering huge discounts, redirecting users to counterfeit storefronts. On marketplaces, fake sellers list high-demand items at unrealistic prices.
Rapid creation and deletion of fake accounts, use of URL shorteners, bot-generated fake reviews, impersonated brand pages.
Luxury items at steep discounts (e.g., 70-90% off), newly created seller accounts, pressure to purchase quickly, only crypto or direct payment methods.
Social-media ad fatigue means users may click without verifying; urgency and fear of missing out (FOMO) further drive impulse buys.
6. Fake Delivery Notifications
With so many parcels expected during Black Friday, scammers exploit this by sending fake messages (email/SMS) claiming a delivery issue and asking recipients to click a link, submit payment or verify details — which leads to phishing or malware.
Posing as major carriers (e.g., DHL, FedEx, UPS), use of tracking links that lead to malicious sites, request for confirmatory payment or account verification.
Notification for a parcel you didn’t order, request for payment to “complete” delivery, tracking number invalid on the carrier’s official site, sender domain differs from official brand.
Shoppers expect many deliveries around Black Friday, which lowers their guard and makes them more likely to act quickly.
7. Counterfeit Products & Marketplace Fraud
On peer-to-peer marketplaces or less-regulated vendor sites, fraudsters list branded goods (luxury or high-demand electronics) at steep discounts. Products either never arrive or arrive as cheap knock-offs. Payment may be requested outside the normal platform protections.
Listings with very few reviews, seller asks for payment via direct bank transfer/crypto, refusal of platform escrow, fake tracking numbers.
Price dramatically below market, seller with no history or ratings, request to communicate off-platform or pay outside standard payment systems, vague product details.
Black Friday increases volume of listings and “he’s selling the same item for far less” appeals to bargain-hunters.
8. Gift Card & Voucher Scams
Attackers promise “free” or heavily discounted gift cards, vouchers or contest wins via email/social media. Some sites ask users to enter wallet addresses or install apps that monitor the clipboard for cryptocurrency addresses.
Use of “giveaway” claims, phishing sites disguised as card-generators, clipboard-monitoring malware targeting crypto payments.
You didn’t enter any contest but get a “you’ve won” email, request to supply gift card codes or pay via gift cards, sites saying “just pay shipping and get your voucher”, apps requesting excessive permissions.
During high-spend seasons people may justify “free gift cards” and click indiscriminately.
9. Fake Charity & Donation Scams
Fraudsters exploit the generosity of the season by creating sham charity websites or campaigns (particularly around Black Friday / Cyber Monday). They impersonate legitimate nonprofits, solicit donations, and take the funds.
Emotional appeals linked to deals (“shop for good and give back”), fake websites, use of real-looking branding, donation links that are fraudulent.
Unsolicited donation request via email/social media, pressure to donate immediately, vague description of how funds will be used, charity not listed in recognized watchdog databases.
The mix of shopping and giving during the holiday period lowers consumer scepticism, and many people pay less attention to verification under the guise of goodwill.
10. Cryptocurrency Payment & Wallet Scams
Some fraudulent retailers or “discount deals” claim that if you pay with cryptocurrency you’ll get extra savings. In such cases, once payment is sent the seller disappears or the website steals wallet credentials. Other schemes prompt users to input recovery phrases or private keys disguised as verification.
Retailers switching to crypto-only payment, apps requesting photo access to scan wallet recovery phrases, fake investment pitch tied to Black Friday offers.
A retailer suddenly accepts only cryptocurrency payment, offers “guaranteed returns” after paying crypto during Black Friday, apps asking for device photo library, or wallet recovery phrase.
Crypto payments are often irreversible, making them an attractive target for fraud; the hype around “cryptocurrency payments for discounts” adds plausible cover.
How Consumers Can Detect & Avoid Scams
Here’s a consolidated checklist to help recognise and evade black-Friday related scams:
- Verify the URL: Check for misspellings, strange TLDs (e.g., .top, .vip), hover over links to preview the target.
- Check HTTPS & certificate: A padlock icon alone is not enough but absence of HTTPS is a strong red flag.
- Evaluate website quality: Poor grammar, low-resolution images, inconsistent branding, broken links or odd layout often indicate fraud.
- Confirm contact and company details: Legitimate sites show full contact info, physical address, support number; test them if possible.
- Check domain age: Use WHOIS or domain lookup — domains newly registered (especially near Black Friday) may be suspect.
- Read online reviews: Search “[site name] + scam” or check independent review sites, social media mentions, BBB equivalents.
- Use security tools: Run URLs through services such as Google Safe Browsing, VirusTotal, APIVoid or ScamAdviser.
- Evaluate deal-legitimacy: If price is ridiculously low (e.g., 70-90% off luxury items), treat as suspicious.
- Check payment & return policy: Legit retailers accept mainstream payment (credit card, PayPal), and show proper return/refund policy. Be cautious if only crypto or gift-card payment is accepted.
- Trust your instincts: If something feels wrong, step away. Don’t let FOMO make you ignore red flags.
Practical Mitigation Strategies
To stay safe this shopping season, consider implementing the following layered defence measures:
- Enable multi-factor authentication (MFA) on all your shopping, banking and payment accounts.
- Use strong, unique passwords (with a password manager) instead of reusing old credentials.
- Prefer a credit-card or virtual-card when shopping online — these often offer better fraud protection than debit cards or direct crypto payments.
- Shop via official retailer websites or verified apps — avoid clicking links in unsolicited emails or social-media advertisements.
- Keep your mobile device and computer updated with the latest patches and run reputable security software.
- For any charitable giving, go directly to the official charity website or donation portal rather than clicking offers in emails or social media.
- If using QR codes, double-check the context: make sure it’s displayed by the legitimate merchant, is not a sticker overlay, and after scanning pause to verify the URL before inputting anything.
- Be especially cautious of deep-discount offers, celebrity-endorsed “gifts”, deals only via crypto payment, or high-pressure “limited-time” prompts.
Add a Comment