Holiday shopping is underway, and millions of consumers are searching for deals, comparing prices, and ordering gifts online. Black Friday and Cyber Monday offer opportunities to save money, but they also create opportunities for cybercriminals.
Online shopping scams are nothing new. What has changed is how convincing they have become. Fraudulent websites can look nearly identical to legitimate retailers, fake advertisements appear alongside authentic promotions, and artificial intelligence (AI) makes it easier to produce realistic messages, product descriptions, and customer reviews.
As a cybersecurity professional, one of my concerns is how easily people can mistake a professional-looking website or advertisement for a trustworthy business. Criminals understand that shoppers are often distracted, in a hurry, or trying to secure a limited-time deal.
The good news is that many of these scams can still be avoided with a few practical precautions. Understanding how they work is the first step.
Holiday Shopping Fraud Is a Significant Problem
Recent research shows just how widespread consumer fraud has become.
According to the FBI’s Internet Crime Complaint Center (IC3), non-payment and non-delivery scams resulted in more than $503 million in reported losses during 2025. Credit card fraud accounted for another $282 million. These figures cover the entire year, not just the holiday shopping season.
A November 2026 AARP survey of 1,801 U.S. adults who use the internet and shop during the holidays found that:
- 84% reported being targeted by or experiencing at least one common type of fraud.
- 47% had received a fraudulent notification claiming there was a problem with a package delivery.
- 35% had given or received a gift card with no available funds.
- 30% had experienced package theft.
These statistics illustrate how fraud can affect consumers through websites, advertisements, payment methods, and even ordinary package deliveries.
Source: AARP, Unwrapping the Truth: Holiday Shopping Scams (2026)
1. AI-Generated Fake Shopping Websites
One of the more concerning developments is how easily criminals can create convincing online storefronts.
In the past, fraudulent shopping websites often contained obvious warning signs, including poor grammar, broken links, or low-quality images. Those indicators still exist, but they are becoming less reliable.
AI tools can help criminals generate professional product descriptions, convincing promotional content, and realistic-looking customer testimonials. Combined with inexpensive website templates and copied retailer branding, these tools lower the effort required to launch fraudulent stores.
According to Norton’s 2026 Holiday Scams Insights Report, security products operated by its parent company, Gen, blocked more than 526,000 domains associated with fake online stores between October and December 2025.
Example: You discover a website advertising a popular electronic device for 60% below its normal retail price. The website looks legitimate, includes customer reviews, and accepts credit cards. After placing your order, you receive a confirmation email, but the product never arrives.
How to protect yourself: Research unfamiliar retailers independently. Check their business information, return policies, and reputation through sources other than their website. Search for the retailer’s name alongside terms such as “scam” or “complaints.”
A professional website is not proof that the business behind it is legitimate.
2. Fake Social Media Advertisements
Social media platforms have become popular shopping destinations, and criminals use that popularity to distribute fraudulent advertisements.
A sponsored advertisement on Facebook, Instagram, TikTok, or another platform may promote discounted electronics, clothing, toys, or other popular gifts. The advertisement can use stolen product photographs, recognizable logos, and links to counterfeit websites.
Some fraudulent advertisements impersonate established retailers. Others promote businesses that do not actually exist.
The 2026 Norton report found that 40% of surveyed Americans said they saw more scam advertisements on social media.
How to protect yourself: When an advertisement catches your attention, visit the retailer’s official website or application independently. Search for the product there rather than assuming the advertisement’s destination is legitimate.
Remember that an advertisement being sponsored or promoted does not mean the seller has been independently verified.
3. Package Delivery Text Messages and Emails
Package delivery scams are particularly effective during the holidays because consumers may have several orders arriving from different retailers.
A typical message claims that USPS, UPS, FedEx, or another carrier cannot deliver a package because of an incorrect address or an unpaid delivery fee.
The message includes a link requesting updated information or a small payment, sometimes only a dollar or two.
The payment amount may seem insignificant, but the real objective may be to collect credit card information, personal details, or account credentials.
How to protect yourself: Never rely on an unexpected text message to resolve a delivery problem. Open the retailer’s website or the shipping company’s official application and check the tracking number directly.
If you cannot identify the shipment, treat the message with suspicion.
4. AI Shopping Assistants and Unverified Retailers
AI shopping assistants are increasingly being used to compare products, research gift ideas, and identify deals.
These tools can be useful, but consumers should understand their limitations.
An AI assistant may identify a retailer offering a lower price without reliably determining whether that business is legitimate. Product recommendations can also rely on incomplete, outdated, or misleading information.
Norton’s 2026 research found that 42% of surveyed Americans planned to use AI tools for holiday shopping. Among U.S. respondents who had previously used an AI shopping assistant or agent, 56% said one had recommended or completed a purchase from a retailer they did not recognize during the previous holiday season.
That does not mean those retailers were fraudulent. It does highlight why independent verification matters.
How to protect yourself: Use AI to research products and compare options, but verify unfamiliar sellers before making a purchase. For tools capable of completing transactions, review the merchant, total cost, shipping terms, and payment details before authorizing an order.
AI recommendations should not replace your own judgment.
5. Fake Customer Support and Retailer Impersonation
Not every shopping scam begins with a fraudulent advertisement.
Some criminals create fake customer support websites, telephone numbers, or social media accounts impersonating legitimate retailers.
A shopper searching for help with an order may encounter a fraudulent support number in search results. The person answering might request account credentials, payment information, or a one-time verification code.
In some cases, criminals may instruct victims to install remote-access software under the pretense of troubleshooting a problem.
How to protect yourself: Obtain customer support contact information directly from the retailer’s official website or application.
Never share authentication codes, passwords, or remote access to your computer with someone claiming to provide customer support.
6. Marketplace and Payment Scams
Online marketplaces are useful for finding discounted or secondhand merchandise, but transactions with unfamiliar individuals introduce additional risks.
A common tactic involves a seller asking the buyer to complete payment outside the marketplace.
The seller may claim that the platform charges excessive fees or that another payment method will speed up the transaction.
Be particularly cautious when someone insists on payment through Zelle, Cash App, cryptocurrency, wire transfers, or gift cards.
These payment methods can be legitimate, but they generally do not provide the same purchase-dispute protections as a credit card.
How to protect yourself: Keep transactions within established marketplace payment systems whenever possible. Use payment methods with appropriate buyer protections, and never assume that a payment can be reversed.
For unfamiliar online retailers, credit cards are generally preferable because of their fraud and billing-dispute protections.
7. Gift Card Fraud
Gift cards remain popular holiday gifts, but they are also attractive targets for criminals.
Some criminals tamper with physical gift cards displayed in stores, obtaining the card numbers and PINs before the cards are purchased. Once money is loaded onto a compromised card, the balance may be stolen.
Other scams involve fraudulent online gift card sellers or requests to pay for merchandise using gift cards.
How to protect yourself: Purchase gift cards directly from trusted retailers. Inspect physical cards for signs of tampering and keep the purchase receipt.
If someone demands gift cards as payment for an order, fee, debt, or supposed emergency, consider that a major warning sign.
8. Fake Reviews and Misleading Product Listings
Customer reviews can help evaluate a product, but they should not be your only source of information.
Fraudulent sellers may use fabricated reviews, copied product descriptions, manipulated images, or AI-generated testimonials to make questionable merchandise appear trustworthy.
A product with hundreds of positive reviews is not necessarily legitimate.
Look for patterns such as repetitive language, reviews posted within a short period, unrelated product descriptions, or photographs that do not match the advertised merchandise.
How to protect yourself: Compare products across multiple independent sources. Pay attention to detailed reviews that discuss actual product use, limitations, and customer service experiences.
For expensive purchases, consider buying from established retailers or authorized sellers.
Five Things That Do Not Prove a Shopping Website Is Legitimate
Consumers often rely on familiar indicators when deciding whether to trust a website. Unfortunately, several of those indicators can be misleading.
1. The website uses HTTPS. HTTPS encrypts communications between your browser and the website. It does not verify that the merchant is honest or that the business is legitimate.
2. The website looks professional. Criminals can copy legitimate designs, logos, product photographs, and checkout pages.
3. The website has positive customer reviews. Reviews and testimonials can be fabricated, manipulated, or copied from other sources.
4. The website appears in a sponsored search result. Paid placement is advertising, not an independent security assessment of the retailer.
5. The website offers familiar payment options. Fraudulent stores may display recognizable payment logos or use legitimate payment processors. Neither guarantees that an order will be fulfilled.
The safest approach is to evaluate the retailer using several independent sources rather than relying on any single indicator.
A Practical Holiday Shopping Security Checklist
You do not need to be a cybersecurity expert to reduce your exposure to shopping scams.
Before making an online purchase:
- Verify the retailer. Research unfamiliar businesses and confirm that you are using their legitimate website.
- Use strong authentication. Enable multifactor authentication or passkeys on important accounts, particularly email, banking, and shopping accounts.
- Choose protected payment methods. Prefer credit cards or established payment services that provide purchase protection.
- Keep devices updated. Install operating system, browser, and security updates.
- Avoid unexpected links. Access retailer and shipping websites independently rather than following unsolicited messages.
- Review account activity. Enable transaction alerts and monitor payment statements for unauthorized charges.
- Be skeptical of urgency. Extremely low prices, countdown timers, and claims of limited availability can pressure consumers into making rushed decisions.
One additional recommendation is to use a password manager. Unique passwords help prevent a compromised shopping account from exposing other accounts that use the same credentials.
What to Do If You Become a Victim
Even careful shoppers can encounter convincing scams. If you believe you have been defrauded, acting quickly can help limit the damage.
If you entered payment information: Contact your credit card issuer or bank immediately. Report the transaction, discuss available dispute options, and determine whether your payment card should be replaced.
If you entered a password: Change the affected password through the legitimate website. If you reused that password elsewhere, change those accounts as well. Review account activity and enable multifactor authentication.
If you installed suspicious software: Disconnect the affected device from the network if compromise is suspected. Use trusted security tools or professional assistance to assess the device before continuing sensitive activity.
If you provided sensitive identity information: Visit IdentityTheft.gov for guidance on protecting your identity, including whether a credit freeze or fraud alert is appropriate.
You can also report suspected fraud to the Federal Trade Commission or the FBI Internet Crime Complaint Center.
Keep copies of transaction records, suspicious messages, and communications with the seller. These may help with disputes and investigations.
Final Thoughts: Shop Smart, Not Scared
Holiday shopping should be enjoyable, not stressful. While cybercriminals continue to develop new techniques, many successful scams still depend on familiar behaviors: trusting an unexpected message, acting on urgency, or purchasing from an unfamiliar seller without checking its legitimacy.
Artificial intelligence has made some fraudulent content more convincing, but it has not eliminated the value of basic security practices.
Take a moment to verify unfamiliar retailers, use payment methods that offer protection, and question offers that seem unusually generous.
A few extra minutes of research can prevent a much more expensive problem.
For additional guidance, read our earlier article, Cyber-Safe Holiday Shopping: Your Ultimate Guide to Online Security.
Stay safe, enjoy the holidays, and remember that a good deal is only a good deal if the seller is legitimate. You may also find our article on fake CAPTCHAs interesting.
Sources and Further Reading
