The inbox fills with shipping updates. The group chat fills with gift ideas. Every store you have ever bought socks from sends a discount code with a countdown timer. It is a wonderful month for bargains, and an even better one for people who make a living pretending to be a store, a courier, or your bank.
Most holiday fraud does not require clever hacking. It requires you to be tired, in a hurry, and looking at something you want at a price that feels like luck. The defenses are unglamorous: check who you are paying, use payment methods with a dispute process, and set a few controls on your cards before the rush begins.
Fake stores and prices that are too good
Counterfeit shops appear fast in November. They are usually built on a cheap template, filled with product photos copied from a legitimate retailer, and promoted through social ads or the sponsored results at the top of a search page. The giveaway is rarely the design. It is the combination of pressure and payment.
- A very new domain. A site registered a few weeks ago is not automatically a scam, but a shop with a decade of reviews and a website born last month is worth a second look.
- Prices far below everyone else. If one store undercuts every major retailer by a wide margin on a popular item, assume you are the product, not the customer.
- Limited payment options. Bank transfer, gift cards, or cryptocurrency only. Card payments can be disputed; a transfer to a stranger usually cannot be reversed.
- No real contact details. No street address, no phone number, no returns policy, or a policy page that reads like it was copied from another shop.
- Perfect reviews hosted only on the site itself. Look for the product name plus the word "scam" or the store name in independent forums.
Two quick checks help. Run the product photo through a reverse image search and see whether it appears on a dozen unrelated shops. Then add something cheap to the cart and look at the checkout: does the payment page stay on the same domain, and does the padlock match the brand you think you are buying from?
When you do buy from an unfamiliar shop, use a credit card or a virtual card number rather than a debit card or a peer-to-peer transfer. Card issuers generally offer a dispute process, though the rules and timelines differ by country and card type. If a purchase goes wrong, ask your issuer what your specific card covers.
Delivery texts, held packages, and small fees
The other seasonal script arrives by text: a parcel is waiting, an address needs confirming, a small redelivery fee is owed. The amount is deliberately tiny, usually a couple of dollars, because the goal is not the fee. It is the card form on the next page, and often a follow-up screen asking for the one-time code your bank just sent you. That code is the whole point of the exercise, and no legitimate courier will ever ask you for it.
Treat any unexpected message about a delivery as untrusted until proven otherwise:
- Do not tap the link. Not to "check", not out of curiosity.
- Open the retailer's app or type the courier's address into your browser yourself.
- Paste the tracking number from your order confirmation, not from the message.
- If the message claims a fee, call the retailer or courier using a number you looked up independently.
Watch for lookalike domains, too: a single swapped letter, a hyphen, or a country code tacked onto a familiar name. On a phone screen at night, with a toddler on your arm, they are easy to miss. Also be wary of "order confirmation" emails with an attachment, and of invoices for items you never bought. Attachments in unexpected invoices are a common way to deliver malware.
Set your card controls before you shop
Most banks and card apps now offer controls that take a few minutes to configure and quietly prevent a lot of damage. Do this while you still have patience and a decent internet connection.
- Turn on instant alerts for every transaction, not just large ones. A two-dollar test charge at midnight is how card testing starts.
- Set spending limits or use a temporary lock when you are not shopping.
- Switch off international transactions unless you are actually travelling.
- Generate virtual card numbers for stores you do not know well. If that number leaks later, you can cancel it without replacing your main card.
- Keep one card for online shopping and a different one for bills, rent, and subscriptions. A compromise then touches one corner of your life instead of all of it.
- Remove saved cards from retailer accounts and browsers you no longer use.
Mobile wallets add another layer, because they send a token instead of your real card number. Where a shop accepts Apple Pay or Google Pay, using it is usually the safer default.
Lock down the accounts that hold your money and your address
A stolen card number can be replaced. A compromised email account is worse, because it is the reset button for everything else. Start there. Use a password manager so every store gets its own password, and turn on two-factor authentication with an app, a passkey, or a hardware key where the option exists. Text-message codes are better than nothing, but they can be intercepted or read from a stolen phone.
Then check the details you rarely look at: is your recovery email still one you control? Is the phone number on file current? Has an unknown device signed in recently? Are there email forwarding rules you did not create? That last one is a favourite trick, quietly piping your receipts and bank notices to someone else.
If something goes wrong
Move quickly and in the right order. Freeze the card in your banking app, then call the number printed on the back of the card, not a number from a message. Change the password on your email account first, then on the shopping account, and sign out of all sessions. Check for forwarding rules and unfamiliar payment methods. Keep screenshots, order numbers, and message headers.
Report the fraud to your bank's fraud team and to your national consumer protection body, such as the FTC in the United States or Action Fraud in the United Kingdom, so the pattern is on record. If the loss is significant, or if a business account is involved, it is worth getting advice from your bank or a consumer protection organisation before you accept any settlement.
A ten-minute setup for the busiest weeks
Do this once, before the sales start. Turn on transaction alerts for every card. Freeze the ones you will not use. Remove stale cards from browsers and store accounts. Confirm that two-factor authentication is on for email and your main bank login. Write down one rule and keep it: no purchases from links in texts or emails, ever. When a deal catches your eye, open the retailer's app or type the address yourself.
That is the whole strategy. Small, boring controls, set up in advance, so a convincing message at the wrong moment has nothing to grab onto. Then get back to the shopping list.
Photo: Kindel Media / Pexels
