While your team hunts for laptop deals and office equipment discounts this Black Friday, cybercriminals are hunting too - for your payment details, credentials, and network access. With employees clicking ads, comparing prices, and tracking more deliveries than usual, attackers know this is the perfect time to strike.
The UK’s National Cyber Security Centre has even warned that Black Friday is becoming “Black Fraud Day,” calling the discount period “prime time” for scams. Last year alone, more than 16,000 cases of online shopping fraud were reported during the holiday season, totaling £11.5 million in losses.
In Canada, the trend is just as concerning. The Canadian Centre for Cyber Security cautions that in the rush to secure deals, it’s “easy to get caught up in the excitement.” Fraud is rising sharply, and according to the Canadian Anti-Fraud Centre, Canadians have already lost over $544 million to fraud in 2025, as of September 30. Digital fraud spikes during the holiday season: 2.6% of Canadian online purchases between Thanksgiving and Cyber Monday were flagged as fraudulent, representing a 51% year-over-year increase.
This article highlights common scams that spike during the Black Friday and Cyber Monday sales period — focusing on two that can hit businesses just as much as consumers: fake shopping websites and parcel/delivery scams. We’ll outline how they work, how to spot them, and how SMBs can protect themselves during the busiest (and riskiest) shopping period of the year.
Common Black Friday Scams You’ll See Everywhere
Holiday cybercrime continues to climb: the FTC recorded more than 50 million online shopping–related fraud reports, with $432 million in losses, and “malvertising” attacks spiked 41% ahead of last year’s sales season (LifeLock/Norton). Here’s a quick look at some common fraud types that surge every Black Friday and Cyber Monday.
1) Fake Online Stores (Cloned Retailer Websites)
Scammers build professional-looking websites that impersonate well-known retailers. They copy logos, product descriptions, reviews, and even layout — then lure shoppers with “door-crasher” pricing. Victims often receive counterfeit items or nothing at all.
2) Fake Social Media & Search Ads
Fraudsters run fake ads on Facebook, Instagram, and Google promoting massive “closing-down sales” or “one-day-only” deals. In one investigation, 50,000 ads used the same scammer text, with 1,600 still active at the time.
3) Parcel & Delivery Scams (SMS, Email, and Voice)
Attackers impersonate Canada Post, UPS, or FedEx with fake “tracking updates,” “missed delivery” alerts, or “customs fee required” notifications.
4) Counterfeit Merchandise & IT Hardware
Scammers use fake websites and marketplace listings to sell counterfeit brand-name products — including electronics and networking gear. Cisco warns that counterfeit devices “pose significant risks to network performance, data integrity, and safety,” and are often sold through unauthorized online resellers.
5) Malvertising (Malicious Ads)
Some ads — often appearing in search results — redirect victims to malware-laced landing pages or fake checkout portals. These attacks jumped 41% during last year’s Black Friday period.
Below, we take a deeper dive into the two most critical scams targeting your business this season: Fake Shopping Websites and Parcel and Delivery Scams.
Fake Shopping Websites: A Convincing Black Friday Scam
If there’s one scam that consistently traps both shoppers and businesses during Black Friday, it’s the fake online store. These sites look polished, professional, and legitimate—often indistinguishable from real retailers. And with AI now helping criminals generate clean copy, realistic product photos, and convincing branding, the old “bad spelling gives it away” test isn’t enough anymore.
Security experts have been raising red flags. In a CBC interview, one cybersecurity CEO said:
“We’ve never seen as many malicious, false, spam or fraud ads as we are seeing today … and now with artificial intelligence, we have rocket fuel poured on fraud.”
Criminals funnel shoppers from social media or search ads to cloned websites promoting “blowout deals,” “warehouse closures,” or “today-only” discounts—all designed to trigger impulse buying.
How Fake Websites Trick You
Fake stores succeed because they mimic the entire online shopping experience so convincingly:
- They copy branding, layout, and product catalogues from legitimate retailers.
- They run paid ads on search engines or social media to appear trustworthy.
- They use look-alike URLs (typosquatting) to blend in with real store domains.
- They create urgency with “today-only” or “final clearance” messaging.
- They use polished product images and descriptions — often AI-generated — to appear authentic.
The Government of Canada highlights examples where scam sites imitate well-known stores, promoting steep discounts and capturing payment information while delivering nothing.
Once you complete a purchase, one of three outcomes is common:
- You get nothing
- You get a counterfeit item
- Your payment details are stolen and used later
How Fake Websites Can Affect SMBs
Consumers aren’t the only ones being targeted. Businesses often buy IT hardware during Black Friday — laptops, monitors, access points, routers, and accessories — making procurement teams a prime target.
Scammers know this and frequently use fake websites to advertise “too good to be true” discounts on brand-name equipment. A polished fake storefront offering “60% off monitors” or “half-price laptops for business” can easily fool a busy administrator or purchasing assistant.
Falling for one of these scams can result in:
- receiving faulty or non-existent equipment
- exposing corporate credit cards
- introducing security risks if counterfeit gear ends up on the network
- costly downtime or replacement delays
For smaller teams without strong procurement controls, it’s easy for a convincing fake site to slip past the usual checks — especially during the holiday rush.
Red Flags to Spot a Fake Shopping Website
Use this checklist to evaluate a site quickly:
- Unbelievable discounts — pricing far below real market value.
- Suspicious domain details — typos, extra words, sketchy URLs, or missing HTTPS.
- Branding inconsistencies — mismatched logos, colours, or poor-quality product photos.
- Website quality issues — broken buttons, missing pages, or copied policy text.
- Lack of transparency — vague shipping information, incomplete refund/return policies, or no contact details.
- Weak online footprint — new social media accounts, no legitimate reviews, or limited web presence.
- Limited payment options — especially when only credit cards are accepted.
Parcel & Delivery Scams: The Surprise Threat During Black Friday
With online orders surging during Black Friday and Cyber Monday, delivery-related scams spike dramatically.
These scams typically arrive by text message, email, or even automated voice calls. They impersonate trusted carriers, including Canada Post, UPS, and FedEx, and rely on urgency to push victims into clicking quickly:
- “Your package is on hold,”
- “Customs fee required,”
- “Delivery failed—update your address.”
During the busiest shipping period of the year, criminals know that people—and businesses—are expecting packages, which makes fake tracking alerts far more believable than usual.
How Parcel & Delivery Scams Work
Attackers impersonate familiar carriers such as Canada Post, UPS, and FedEx, using branding, logos, and urgent language to appear legitimate. Common tactics include:
- Fake tracking links that lead to fraudulent websites
- Requests for small “release fees” to steal credit card information
- Malicious attachments disguised as invoices or shipping documents
- Spoofed login pages designed to steal personal or payment information
UPS warns that fraudsters frequently send fake notifications using UPS branding, often linking to non-UPS websites or demanding payment—something UPS does not do through unsolicited communication.
Canada Post also cautions that scammers imitate their tracking emails despite the fact that Canada Post never requests personal or financial information by email to release a package.
Why SMBs Are Especially Vulnerable
Parcel scams don’t just target private shoppers—they hit businesses hard.
1) A spike in both business and personal deliveries
Offices often receive dozens of packages during Black Friday week, making fake alerts blend in easily.
2) Business information is more valuable
If an employee follows a fake link and enters sensitive details, attackers can misuse:
- Payment card details
- Corporate addresses and phone numbers
- Personal identifying information
Any of these can be leveraged in later scams or fraud attempts.
3) Busy employees tend to trust familiar logos
The combination of high workload, high delivery volume, and brand recognition makes it easy for even trained staff to click without thinking.
The Business Cost of One Click
When an employee clicks a fake delivery link on a work device:
- Immediate: Payment card fraud, credential theft
- Extended: Phishing attacks using stolen corporate email addresses
- Worst case: Network Compromise and Ransomware deployment via malicious attachments
How to Verify Delivery Messages Safely
Canada Post and UPS recommend a few simple habits that go a long way toward staying safe:
- Treat unexpected messages as suspicious by default. If you didn’t sign up for tracking alerts, it’s safer to delete the message.
- Never click links or open attachments in a message you weren’t expecting. Go to the carrier’s website directly and enter the tracking number yourself.
- Don’t reply or “unsubscribe” from sketchy messages. Replying or texting “STOP” can confirm your number or address is active.
- Never share personal or financial information (ID, banking details, credit card numbers, Canada Post login, etc.) in response to an email or text.
- Check the sender carefully. Watch for odd-looking email domains (e.g., parcel-delivery-canadapost.ca) or phone numbers that don’t match official short codes.
- Look for classic scam signs: generic greetings (“Dear Customer”), spelling and grammar errors, excessive exclamation marks, or pushy language telling you to “act immediately” or risk losing your delivery.
Practical Protection Steps for Businesses
For most businesses, staying safe during Black Friday comes down to slowing the pace of decision-making and helping staff recognize what “normal” looks like during a high-volume shopping season. The scams themselves aren’t new — but the distraction of deals, deadlines, and increased shipping volume makes people more likely to trust the wrong website or vendor.
Here are four practical ways to protect yourself or your business:
1) Be deliberate about where purchases come from
Businesses often use Black Friday to buy laptops, monitors, networking hardware, or office tech — which is exactly why scammers concentrate fake sites and ads around these categories. Stick to:
- well-known vendors
- authorized resellers
- official manufacturer sites
This step removes most risk before it begins.
2) Check the retailer’s digital footprint
Many fake websites and social accounts appear only days before the sales period starts. A quick review can reveal a lot:
- How long has the domain existed? (Tools like who.is make this easy.)
- Do they have credible reviews from real customers?
- Do their social channels look newly created?
If a brand seems to have materialized overnight, treat it with caution.
3) Use technical safeguards in the background
Security tools can automatically block malicious domains, fake shopping sites, and risky links before an employee ever reaches them. Examples include:
- DNS filtering: blocks access to newly registered domains (the majority of fake shopping sites are less than 30 days old)
- Endpoint protection: stops malware from executing if a fake delivery attachment is opened
- Email security gateway (ESG): a protective barrier between the internet and your email server. Includes services like spam filtering and phishing protection
If you don't have these controls in place, a quick security audit can identify vulnerabilities before they are exploited. Contact us for a free assessment.
4) Train your team before the sales period begins
People naturally take shortcuts when they’re busy, and scammers rely on that. A quick reminder to staff goes a long way. Reinforce basics such as:
- don’t install shopping apps on work devices
- avoid using corporate cards for personal purchases
- be skeptical of unexpected deals
- review the tips shared in this blog
Most Black Friday scams succeed not because they’re sophisticated, but because they land at the exact moment when attention is most divided.
Stay Sharp, Slow Down, and Shop Smart
Black Friday and Cyber Monday bring real opportunities for savings, but they also create the perfect environment for online scams to thrive. Fake shopping websites, misleading ads, and delivery-related fraud all rely on the same thing: people moving quickly and trusting what looks familiar.
The good news is that most of these threats can be avoided with awareness and a few good cyber practices.
- Slow down when a deal seems too good.
- Stick to trusted vendors.
- Verify delivery messages directly with the carrier.
- Remind your teams of the signs to watch for.
Don't Wait Until After a Breach
Unsure of your cyber security posture? Contact us today to learn about our cyber awareness training and other technical safeguards like DNS filtering and email security to keep your team safe on Black Friday and beyond.