Online holiday shopping has hit a peak.
Adobe Analytics showed that online holiday spending hit new records, with Cyber Monday jumping 7.3% year-over-year to $13.3 billion in 2024. But that’s not all, Cyber Week, the five-day buildup from Thanksgiving through Cyber Monday, generated $41.1 billion in online sales, marking an 8.2% YoY increase.
Consumers are shopping smarter, too. AI-powered chatbots are influencing purchase decisions, guiding shoppers to deals faster, and driving more traffic to retailers during peak season.
Black Friday and Cyber Monday are also peak seasons for scammers looking to profit on distracted, deal-hungry shoppers through phishing attacks, advanced social engineering tactics, credential theft, account takeovers, smishing (SMS phishing), quishing(QR code phishing), fake gift card promotions, malvertising campaigns, ransomware, and incredibly convincing retailer impersonations.
Your clients might be unaware of these threats until it’s too late.
That’s why we’ve curated a list of 37 holiday online shopping scam statistics that MSPs should be prepared to identify, mitigate, and educate their clients about before any attacker turns a holiday deal into a costly security incident. Here we go.
Key Takeaways
- Black Friday and Cyber Monday drive record online shopping volumes, creating peak conditions for cyber attacks targeting MSP clients.
- Holiday themed phishing surges dramatically during Cyber Week, with retail impersonation, payment focused scams, SMS and QR phishing, and AI driven attacks exploiting distracted shoppers.
- Identity theft and account takeover activity spikes ahead of major shopping events.
- Ransomware and large scale fraud increasingly occur on weekends and holidays, when staffing is reduced and response windows are slower.
The Holiday Phishing Surge
- Phishing attacks account for 42% of Black Friday-specific threats, with 32% targeting digital wallets and payment systems. Cyber Security News
- Black Friday emails alone saw a 495% increase from October to early November. McAfee Labs
- Phishing attacks soar 692% in the buildup to Black Friday and Cyber Monday. Darktrace
- Phishing attacks impersonating major U.S. retail brands surged over 2,000% during peak shopping season. Darktrace
- Christmas-themed phishing attacks climbed 327% worldwide during Black Friday week. Darktrace
- APWG observed 989,123 phishing attacks in Q4 2024. APWG Phishing Activity Trends Report 4th Quarter 2024
Fraud Friday: Online Shopping Scams at Scale
- 77% of all Black Friday-themed spam emails in 2024 were scams. Bitdefender
- Phishing emails advertised Ray-Ban sunglasses for just $27.99, redirecting users to fake sites. Bitdefender
- Visa PERC identified a 284% increase in fake and spoofed merchant websites as compared to the prior 4 months. Visa 2024 Holiday Threats Report
- E-commerce platforms see a 65% increase in phishing attacks during Black Friday sales. CoinLaw
- Research revealed a 41% increase in malvertising scams ahead of Black Friday and Cyber Monday in 2024. PR Newswire
- Holiday scams surge 309% at the peak of the shopping season. Arkose Labs
- Forter reported an 8% rise in remote access attacks during the 2024 Black Friday/Cyber Monday period compared to 2023. Forter
- Bots and fake users made up 35.7% of all online shoppers on Black Friday. CHEQ
- In 2024, online scams increased by over 400% during Black Friday. SEON
- RH-ISAC projects a 520% spike in AI-driven traffic during the 10 days prior to Thanksgiving. RH-ISAC
- Kaspersky saw a 25% surge in retail-focused cyberthreats before Black Friday. Kaspersky
Identity Theft and Account Takeovers (ATO) Hit Peak Season
- Consumers reported 21,403 incidents of online identity theft to the FBI in 2024. CapitalOne Shopping Research
- In Q3 2024, sales of stolen accounts climbed roughly 16%, with the retail sector remaining the top target. Kasada
- The most common targets for ATO are social media accounts (51% of attacks). CapitalOne Shopping Research
- 17% of organizations do not have an identity recovery plan in place. Semperis 2024 Ransomware Holiday Risk Report
- ATO attacks soared 250% in 2024, fueled by seasonal traffic exploitation. Kasada
- Retail account sales on criminal marketplaces surged ahead of major shopping events, with the 2024 holiday season (Nov-Dec) comprising around 36% of all account sales that year. Kasada
- A major retailer suffered a 32x increase in bot-driven login attempts on Black Friday, with 72% of total traffic coming from malicious bots. Kasada
- Research revealed a 92% rise in malicious configurations targeting the retail sector between January and October 2025. Kasada
- Within a single month, Kasada detected over 1,100 credential-stuffing attacks targeting 133 retailers, compromising an estimated 265,000 accounts. Kasada
- There were over 311 million stolen accounts listed across dark web marketplaces in 2025, with 63% belonging to retail brands. Kasada
- Malicious scripts used for credential stuffing, scraping, and automated checkout are now being deployed 10 to 14 days before peak sales. Kasada
Seasonal Spike in Ransomware Attacks
- 50% of companies experienced a ransomware attack after a material corporate event. Semperis 2024 Ransomware Holiday Risk Report
- 86% of ransomware victims were targeted on a weekend or holiday. Semperis 2024 Ransomware Holiday Risk Report
- Ransomware attacks double during high-volume shopping weekends, with average demands topping $250,000 per incident. CoinLaw
- 40% of organizations reported having no ransomware recovery budget. Semperis 2024 Ransomware Holiday Risk Report
The Costs of Online Shopping Fraud
- According to the Federal Trade Commission (FTC), online shopping was listed as the second most common type of fraud in 2024, with over 380,000 reports, resulting in $432 million in consumer losses. FTC Consumer Sentinel Network Data Book 2024
- Consumers reported $432 million in direct fraud losses from online shopping scams in 2024. CapitalOne Shopping Research
- eCommerce-related identity fraud increased 137% between 2023 and 2024. CapitalOne Shopping Research
- U.S. consumers lost a total of $70.0 million to phishing attacks in 2024. CapitalOne Shopping Research
- Business email compromise (BEC) costs an average of $126,000 per incident. CapitalOne Shopping Research
Keep Your Data Safe This Holiday Season with Guardz
AI is making online holiday scams more complex for MSPs to detect, as attackers can now automate phishing campaigns and launch account takeover attempts at scale. But before any holiday-themed phishing scam can land in your clients’ inboxes, MSPs need to take a proactive security approach. Guardz leverages LLM-enhanced threat detection, contextual analysis, and historical sender behavior to flag anomalies and suspicious emails.
Guardz is also excited to partner with Check Point to bring Harmony Email Security (formerly Avanan) into our unified cybersecurity platform. Together, Guardz and Check Point reduce phishing emails by 99.2% before they reach the inbox by connecting the security dots.
Don’t fall for those Black Friday and Cyber Monday-themed phishing scams this holiday season. Protect your clients’ inboxes with the Guardz unified cybersecurity platform.
Schedule a demo today.
