Holiday Shopping Scams: A Seasonal Checklist for Safe Online Deals
The discounts are real. So are the sites that exist only to collect card numbers. Every November, shopping traffic climbs, and with it the number of copycat storefronts, fake courier texts and marketplace sellers who vanish the moment payment clears. None of it requires clever technology. Most of it works because we are in a hurry, we have six tabs open, and a bargain is hard to resist. What follows is the routine worth running through before you type a card number this season — and what to do if you already did.
Three conditions make holiday shopping unusually easy to exploit. Volume: you place more orders than usual, so a message about a parcel you don't quite remember ordering does not feel strange. Unfamiliarity: you buy from shops you have never used, because they claim to have the item in stock. Urgency: "only 3 left", countdown timers, "this price expires in 15 minutes".
Legitimate retailers use scarcity language too, so it is not proof of anything on its own. It is a signal to slow down rather than speed up. Treat any message or page that pushes you to act within minutes as something to verify separately — in a new tab, by typing the retailer's address yourself.
Look at the domain, not the design. Fake shops often misspell a known brand or bolt on a word that sounds official: brand-official-outlet, shop-eu-store, brand.sale. A padlock icon only tells you the connection is encrypted. It says nothing about whether the seller is honest, and scam sites have padlocks too.
Real shops publish returns, shipping, terms, privacy and contact details, because they have to. Fake ones often have a thin returns page, no postal address, and a contact form as the only way to reach anyone.
A price far below every other retailer on an in-demand item — especially when that shop has every size and colour in stock while everyone else is sold out — is a warning, not a stroke of luck. Searches on product photos can also help: if the same image appears on a dozen unrelated domains, you are not looking at a real inventory.
Red flags worth naming:
Some payment methods can be reversed. Some are gone the second you confirm. Where you have the choice, pay with a credit card: in many countries card issuers give you chargeback rights when goods never arrive or are not as described. Debit cards vary. Bank transfers are usually final, gift cards are almost always final, and cryptocurrency is final by design.
If you would rather not expose your main card, ask your bank about single-use or virtual card numbers, which limit the damage if the details leak. When paying a stranger through a payment service, use the purchase-protection option rather than the "send money to a friend" option — the cheaper one usually removes your protection. And check out on the retailer's own site rather than through a payment page you reached from an email link. Consumer protections differ by country and by issuer, so if you are unsure what applies to you, that is a two-minute question for your bank.
When you are expecting four parcels, a fifth message feels plausible. The pattern is consistent: a short text or email saying a delivery failed, a link to a page that asks for a small redelivery charge, and a form that wants your full card details and sometimes a login. The small amount is the point — it is easy to approve without thinking.
Do not click. Open the courier's website or app directly and enter the tracking number from your own order confirmation. If the message was genuine, the tracking will say so. Real carriers rarely ask for payment through a link in an unexpected text, and a message that pressures you to pay within 24 hours before your parcel is "returned to sender" is almost always a harvesting attempt. Order confirmations and shipping notices are also worth keeping, so you have something independent to check against.
Buy inside the platform. The moment a seller asks to move the conversation to a messaging app and take payment by transfer, you have lost the dispute process that would have helped you. Before paying, look at how long the seller has been active and read the reviews that mention non-delivery, not just the overall rating.
With social media ads, click through to the shop and check the domain and contact details before buying. Ads get cloned, and a convincing video is cheap to produce. Finally, remember the rule that holds without exception: no legitimate retailer, delivery company, tax authority or employer asks to be paid in gift cards. The request itself is the fraud, whatever story comes with it.
Speed matters more than embarrassment, and it is worth acting the same day. Call the number printed on the back of your card — never a number from the suspicious email — and ask for the card to be blocked and a disputed charge to be opened. The sooner a charge is contested, the better your position, and your bank's fraud team is the right first call.
Report it, too: in the United States through the FTC's ReportFraud site, in the United Kingdom through Action Fraud, and in either case to the platform if the sale happened on a marketplace. If you entered a password on a fake site, change it everywhere you reused it and turn on two-factor authentication for your email and banking. Keep screenshots, emails, order numbers and times.
If the sum involved is large, or the card belongs to a business, follow up in writing with your bank and consider taking advice from a lawyer or accountant about your options. Nothing here substitutes for guidance from your bank or a qualified professional.
None of this is complicated. Verify the seller, choose a payment method you can reverse, and refuse to let a countdown timer make the decision for you. Do those three things consistently and almost every seasonal scam runs out of ways to reach you.
Photo: athree23 / Pixabay
Previous Post
What Is Zero Trust? A Plain-English Explainer for Non-IT Staff
Next Post
Privacy Settings Audit: How to Lock Down Social Media in One Evening
