Introduction
November 2024 — The holiday season is a time of joy, celebration, and incredible shopping deals that can bring a little extra sparkle to the end of the year. For the 83% of consumers who plan on doing some holiday shopping online this year, the convenience and variety offered by e-commerce make it the go-to option for crossing items off gift lists. However, while shoppers are busy hunting for discounts and special offers, cybercriminals are equally active, setting traps to take advantage of the surge in digital transactions.
The allure of secure online holiday shopping lies in the promise of snagging great deals without compromising your financial safety or personal information. Unfortunately, cyber threats — ranging from phishing scams and fake websites to data breaches — loom large during this bustling season. Without the right precautions, a simple online purchase can lead to unintended consequences, including identity theft or fraud.
As you embark on your digital shopping sprees this holiday season, this guide will help equip you with the knowledge and strategies to outsmart cyber risks and focus on finding the perfect gifts for your loved ones.
How Much Does Cyber Crime Increase During the Holiday Shopping Season?
The holiday shopping season is not just a busy time for retailers and consumers — it’s also the peak period for cybercriminal activity. According to recent reports, cybercrime incidents surge by about 30% during the holiday season compared to other times of the year. This spike is fueled by the sheer volume of digital transactions and the heightened sense of urgency among shoppers eager to secure limited-time offers and holiday discounts.
One of the primary reasons for this rise in cybercrime is the behavior of holiday shoppers. With consumers rushing to find the best deals, cybercriminals often exploit this urgency by deploying fake websites, fraudulent advertisements, and phishing emails that mimic trusted brands. These scams often promise unbelievable discounts or exclusive offers, luring unsuspecting shoppers to provide sensitive information such as credit card details and personal data.
Another factor contributing to the increase in online threats is the high volume of email marketing and promotional messages during this time. While legitimate retailers flood inboxes with holiday deals, cybercriminals camouflage their attacks within the noise, making it difficult for consumers to distinguish genuine offers from malicious ones. Additionally, with so many people shopping across multiple platforms, including mobile apps and social media, the attack surface for cybercrime grows exponentially.
Understanding this seasonal trend highlights the importance of practicing secure online holiday shopping habits. By staying vigilant and verifying the authenticity of websites and emails, and using trusted cybersecurity toolkits, you’ll be better positioned to outsmart malicious actors.
How to Be 100% Protected When Shopping Online During the Holidays?
The short answer is: you can’t.
No matter how careful or prepared you are, achieving 100% protection when shopping online simply isn’t possible. However, this doesn’t mean you’re powerless against cyber threats. While total immunity from cyber risks remains out of reach, adopting the right habits and tools can significantly reduce your exposure to threats and ensure a safer online shopping experience.
Why Absolute Protection Is Unattainable
Cybersecurity is a constantly evolving field, and cybercriminals are always developing new techniques to exploit vulnerabilities. Even the most secure platforms can be targeted by sophisticated attacks, and human error — like clicking on a fraudulent link or using the same password across multiple accounts — can compromise even the most cautious individuals. This reality sheds light on the importance of focusing on minimizing risks rather than seeking an impossible guarantee of safety.
Common Online Scams to Watch Out for During the Holidays
With the holiday season being a prime time for cybercriminals to target shoppers eager to find the best deals, educating yourself about the most common scams can help you identify red flags and protect yourself while enjoying secure online holiday shopping. Here’s are some of the more common online scams to watch out for:
Phishing, Smishing, and Fake Online Stores
Phishing (fake emails) and smishing (fake text messages) typically masquerade as trusted brands, offering exclusive discounts or notifying you of “issues” with recent orders. These messages typically include links that direct you to fraudulent websites designed to steal your login credentials, payment information, or personal data. Similarly, fake online stores often mimic legitimate retailers, presenting an attractive façade that conceals their true intent to defraud shoppers.
“Too Good to Be True” Offers on Social Media
Social media platforms have become a popular avenue for promoting fraudulent offers that seem irresistible — we’ve all seen posts advertising things like ‘designer handbags for 90% off’ or ‘newly released electronics at rock-bottom prices’. These scams often lead to fake websites where payments are processed, but the promised items never arrive.
Holiday-Themed Malware Links and Fraudulent Gift Cards
Cybercriminals also use holiday-themed emails, ads, or pop-ups to distribute malware. These links may claim to offer special discounts, but clicking them can download malicious software onto your device. Fraudulent gift cards are another common scam, often sold at suspiciously steep discounts, leaving recipients with worthless cards.
Shipping and Delivery Scams
During the holiday rush, scammers often attempt to exploit the increase in package deliveries by sending fake tracking notifications or delivery failure notices. These messages typically urge recipients to click on a link to resolve the issue, which can lead to phishing sites or malware downloads.
Charity Scams
Cybercriminals also take advantage of the season of giving by creating fake charities or crowdfunding campaigns. These tactics prey on the goodwill of holiday shoppers, convincing them to donate money that will never be used for the advertised cause, or even causes that don’t exist. We dive deeper into charity and donation scams later in this article.
Unsecured Payment Portals
Some scams involve directing shoppers to payment pages that appear legitimate but are actually designed to harvest credit card details. Never provide payment details or personal information on a site whose URL begins with HTTP – always verify the URL starts with “HTTPS” (note: the ‘S’ is the critical letter to look for here) and includes a padlock or tuner icon in your browser’s address bar.
By staying aware of these common tactics, you can navigate the holiday shopping season with confidence and avoid becoming a victim of cybercrime. Remember, the best defense is a cautious and informed approach to every transaction.
What Are the Best Practices to Stay Safe When Shopping Online for the Holidays?
The holidays are filled with shopping events like Black Friday, Small Business Saturday, and Cyber Monday — making it one of the most exciting times to find deals. Following best practices can help ensure secure online holiday shopping and protect your personal and financial information from falling into the wrong hands.
Use Strong, Unique Passwords for Online Shopping Accounts
A unique and robust password is your first line of defense against cyber threats. Never reuse passwords across multiple websites, as this creates a vulnerability if one account is compromised. Instead, create unique passwords that combine uppercase and lowercase letters, numbers, and symbols, or passphrases like three random words strung together. To manage multiple accounts securely, consider using a password manager, which generates and stores complex passwords, reducing the likelihood of human error.
Enable Multi-Factor Authentication (MFA) Where Possible
Add an extra layer of protection to your online shopping accounts by enabling multi-factor authentication (MFA). With MFA, even if someone obtains your password, they’ll need an additional verification step — such as a one time use code sent to your phone — to access your account. (This is sometimes also called two-factor authentication, or 2FA.)
Use Credit Cards Instead of Debit Cards
Whenever possible, use credit cards for online purchases. Credit cards typically offer better fraud protection than debit cards and provide a buffer by not linking directly to your bank account. If your information is compromised, this extra layer can limit the financial impact.
Also beware: scammers often prefer payments that are untraceable or nearly impossible to dispute, such as cryptocurrency, gift cards, and person-to-person payments.
Check Website Security Before Entering Information
As mentioned above, before entering sensitive data like payment details, verify the website’s security. Look for “HTTPS” in the URL and a padlock or tuner icon in the address bar, which indicates that your personal information is being encrypted. Never enter financial or other personal information in a site that only uses “HTTP” (note the missing ‘S’), as they lack essential security protocols.
Avoid Storing Payment Information on Websites
While it may be tempting to save your payment details for faster checkout, this convenience can expose your financial data if the website is hacked. A few seconds saved from re-entering your information with each transaction is a small price to pay for enhanced security.
Use Virtual Credit Cards or Digital Wallets
Digital wallets like Apple Pay and Google Pay offer added security by encrypting your payment information and sharing a randomized transaction code with merchants. Similarly, many banks now provide virtual credit cards with unique, temporary numbers for online transactions. Both options help keep your actual credit card details private and secure.
Be Cautious with Email Links and Pop-Ups
Be cognizant of the increase in email phishing scams during the holidays, with fake promotional emails and pop-ups designed to trick you into revealing sensitive information. Instead of clicking links in emails, navigate directly to the retailer’s website by typing the URL into your browser.
Monitor Your Accounts Regularly
Frequent monitoring of your bank and credit card statements can help you quickly spot unauthorized charges. Reporting any suspicious activity promptly minimizes potential damage and ensures faster, smoother resolution.
Keep Your Software and Devices Updated
Ensure your operating system, apps, and devices are up-to-date. Security patches released through updates often address vulnerabilities that cybercriminals exploit.
Avoid Public Wi-Fi When Possible
Public Wi-Fi networks are often unencrypted, making it easier for hackers to intercept your data. When possible, you should avoid shopping on public Wi-Fi. Instead, use a personal hotspot or a virtual private network (VPN) for a more secure connection.
For added protection, consider using a service like Quad9 — a free, secure DNS service that blocks access to known malicious domains, providing an extra layer of defense against phishing and malware attacks.
Taking a proactive approach to cybersecurity ensures that your focus remains on finding the perfect gifts — not dealing with the fallout of cybercrime.
Using Security Tools in the Global Cyber Alliance Cybersecurity Toolkit
When it comes to secure online holiday shopping, having access to trusted resources can make a significant difference in protecting your personal and financial information. The Global Cyber Alliance Cybersecurity Toolkit for Individuals offers a range of free tools designed to enhance online safety and minimize your risk of falling victim to cybercrime. These user-friendly tools and resources are perfect for shoppers who want to navigate the holiday season with confidence.
This free toolkit provides practical solutions for common cybersecurity challenges faced by online shoppers. From secure DNS options that block access to known malicious websites to phishing awareness resources that can help you identify scams, these tools are tailored to improve your overall security posture. They are especially valuable during high-risk times like Black Friday and Cyber Monday with the ramp up of cybercriminals’ efforts.
“…But I Don’t Have the Time For This”
We get it, time is a valuable, finite resource…but before you completely dismiss committing a few minutes to proactively improving your cybersecurity, consider this — research suggests individuals can spend weeks or even months resolving identity theft issues. Working these free tools into your online shopping routine is a simple yet effective way to protect yourself. They require minimal effort to set up or integrate into your online shopping workflow but provide significant safeguards against many common threats. With these free resources at your disposal, you can confidently enjoy the convenience and excitement of holiday shopping without unnecessary worry.
Why You Should Also Practice Safe Shopping Habits When Donating Online
Donations are the lifeline for countless organizations, especially during the holiday season, when generosity runs high. Charitable contributions can help enable vital programs, provide resources to underserved communities, and support causes that make a difference worldwide. However, the season of giving is viewed as the “season of taking” by cybercriminals, who exploit the spirit of generosity to carry out scams targeting unsuspecting donors. Practicing online safety habits while donating is essential to ensure your contributions reach the intended recipients.
The Rise in Holiday-Season Donations — and Scams
The holidays see a significant increase in charitable giving, with movements like Giving Tuesday driving a surge in online donations. Unfortunately, cybercriminals frequently try to capitalize on this heightened activity by creating fraudulent charities and impersonating reputable organizations. Scammers often use emotional appeals and time-sensitive messaging to pressure individuals into making quick decisions without verifying the legitimacy of the cause.
Best Practices for Secure Online Donations
To protect yourself and ensure your contributions make a real impact, we recommend following these best practices when donating online:
Be Careful Who You Donate To
Always verify the legitimacy of the organization before donating. Scammers often mimic well-known charities or create fake websites that look nearly identical to legitimate ones. Avoid clicking on donation links sent via unsolicited emails or social media messages. Instead, navigate directly to the charity’s official website.
Research the Organization Using a Tool Like Guidestar
Before making a donation, consider using free resources like Guidestar to verify the organization’s legitimacy and financial accountability. Guidestar provides detailed information about nonprofits, including their mission, programs, and tax-exempt status. This quick step ensures your money supports reputable causes and not fraudulent schemes.
Support Verified Causes Like Giving Tuesday
Giving Tuesday, held annually after Thanksgiving, is a global movement encouraging charitable donations. While it’s an excellent opportunity to support meaningful initiatives, scammers often exploit its popularity by creating fake campaigns. Ensure the organization is vetted and credible before contributing, and check sources carefully to confirm your donations are going to the intended cause.
Avoid Sharing Personal Information Unnecessarily
Legitimate charities will never ask for sensitive details like your Social Security Number or account passwords. Be cautious of forms that request more information than necessary, as this could be a phishing attempt to steal your identity or financial data.
Donate Through Secure Websites
Just as we highlighted in our holiday shopping best practices above, be sure to only donate to a charity website that uses “HTTPS” rather than “HTTP” in its URL.
Make Your Giving Impactful and Safe
Your generosity has the power to drive change, but it’s crucial to ensure your contributions are safeguarded from cyber threats. By taking these precautions, you can support the causes you care about without falling victim to scams.
If you’re interested in supporting cybersecurity initiatives, we ask that you consider contributing to the Global Cyber Alliance, which works tirelessly to create safer online environments for everyone.
The Takeaway | Secure Online Holiday Shopping
The holiday season is a time for joy, celebration, and connecting with loved ones — and for many, that includes the convenience and excitement of shopping online. However, the increase in digital activity also makes this a critical time to prioritize cybersecurity. Practicing secure online holiday shopping habits is essential to protect your financial and personal information from the growing threats posed by cybercriminals.
The Global Cyber Alliance has several tools to help you be secure this holiday season, including CyberFlex aimed at young adults and Actionable Cybersecurity Tools (ACT) which includes a section for scam victims.
By staying vigilant and incorporating simple strategies, like those we’ve shared in this guide, you can significantly reduce your risk of falling victim to cybercrime. Sharing these tips not only helps others enjoy a safer holiday shopping experience but also strengthens the broader effort to combat cyber threats.
This holiday season, make cybersecurity part of your shopping checklist. By taking a proactive approach, you can focus on finding the perfect holiday deals without worrying about holiday steals. Here’s to a safe, secure, and joyful holiday season from everyone at the Global Cyber Alliance.
