Black Friday scams 2026: 9 scams targeting your employees, and how to stop them

In brief: Black Friday is the busiest week of the year for phishing. In 2025, Black Friday-themed phishing rose by 620% in the weeks before the sale, Amazon was impersonated in roughly 8 out of 10 brand-phishing attempts, and about 1 in 11 newly registered Black Friday domains was malicious. The problem for employers: most of that shopping happens on work laptops and work phones, in the inbox your employees also use for invoices and logins. Below are the nine scams that reach your company in November, and a five-rule briefing you can forward today.

Why Black Friday is a company problem, not a consumer problem

Attackers do not care whether a click happens at home or at work. They care that in late November everyone expects parcel notifications, order confirmations, discount codes and “your payment failed” messages. That expectation is what phishing exploits. Three things make the period risky for organizations specifically:

• Work devices, private shopping. A fake delivery notice opened on a company laptop can deliver malware to the company network, not to a home PC.
• Mixed inboxes. Employees who use their work address for webshops receive consumer phishing at work, where it sits next to real supplier emails.
• Year-end pressure. Finance teams close the year, HR processes bonuses, everyone is busy. Urgency-based scams land better when people are rushed.

The 9 Black Friday scams that reach employees

1. The fake delivery notification

“Your parcel could not be delivered. Pay €1.95 to reschedule.” Sent by email or SMS (smishing), using PostNL, DHL, DPD, UPS or a generic “Parcel Service” name. The €1.95 is not the goal; the card details are. In November, when everyone is waiting for something, this is the highest-volume scam of all.

Tell-tale sign: a fee for a parcel you did not order, and a link that does not go to the carrier’s own domain.

2. The brand lookalike webshop

Ads and emails for “Black Friday: 70% off” from a domain that looks like a known brand: nike-blackfriday-outlet.com, bol-deals.shop. The shop takes payment and ships nothing, or ships counterfeit goods. Check Point found roughly one in eleven new Black Friday domains to be malicious.

Tell-tale sign: a domain registered weeks ago, prices far below everyone else, and only bank transfer or crypto as payment.

3. The order confirmation you never placed

“Thank you for your order of €899. If this was not you, cancel here.” The link leads to a fake login page for Amazon, Apple, PayPal or Microsoft. Amazon alone accounted for around 80% of brand impersonation in Darktrace’s 2025 analysis.

Tell-tale sign: you are asked to log in to cancel. Real shops let you check orders by opening the app or site yourself.

4. The QR code deal

Posters, flyers and emails with a QR code: “Scan for your exclusive Black Friday voucher.” Scanning moves the victim to a phone, outside the company’s email filters, where a fake login page waits. This is quishing, and it is growing because email security tools cannot read what is inside an image.

Tell-tale sign: a QR code is the only way to get the deal.

5. The “your payment failed” message

Streaming services, webshops and even SaaS tools: “Your payment could not be processed. Update your card within 24 hours.” At work this version is dangerous because it also targets company subscriptions, and the person who pays the invoices is exactly the person who will act.

Tell-tale sign: deadline plus a link to “update payment details” instead of an instruction to log in to the service.

6. The supplier with a Black Friday invoice

Business email compromise with a seasonal twist: a known supplier emails a discounted year-end invoice, or a “Black Friday offer, pay before Monday”, with new bank details. The sender address may be real, because the supplier’s mailbox was compromised.

Tell-tale sign: changed bank details and a deadline. Verify by phone on a number you already have.

7. The gift card request from “the boss”

“Can you buy 10 gift cards for the team as a Black Friday surprise? I’m in a meeting, send me the codes.” CEO fraud peaks around holidays because the request sounds plausible. Gift cards were the most common payout method in business email compromise in 2025 according to APWG.

Tell-tale sign: secrecy, urgency and an unusual channel (WhatsApp, personal email).

8. The charity and “giving Tuesday” appeal

The Tuesday after Cyber Monday is Giving Tuesday. Fake charities, often with real-looking logos, ask for donations via a link. At work these appeals arrive as “company matching program” emails.

Tell-tale sign: donation links in email; real campaigns point you to a website you can find yourself.

9. The browser extension and “coupon finder”

“Install this extension to find the best Black Friday discounts automatically.” Some are legitimate; others read everything the browser does, including company logins. On a work laptop this is a data-leak waiting to happen.

Tell-tale sign: an extension that asks to “read and change all your data on all websites”.

What this looks like on your network

A single click on scam 1, 3 or 5 usually ends in one of three ways: stolen credentials that are tried on the company Microsoft 365 account within hours, a malicious download that gives an attacker a foothold on the laptop, or a card payment that is the start of a fraud. Scams 6 and 7 go straight for company money. None of these require a sophisticated attacker; they require one busy employee in the last week of November.

The 5-rule Black Friday briefing (copy and send)

Three things IT can do this week

• Run a seasonal phishing simulation. A fake parcel notification in the second week of November shows who would click before the real ones arrive, and the follow-up training lands while the topic is current. Guardey’s phishing simulations include delivery and order-confirmation templates.
• Block newly registered domains for two weeks. Most Black Friday scam domains are days old. A DNS filter rule for domains younger than 30 days removes a large share of the risk with no user impact.
• Remind the finance team separately. Scams 6 and 7 target them specifically. A two-minute conversation beats a company-wide email.

Frequently asked questions

Are Black Friday scams really worse than the rest of the year?

Yes. Darktrace measured a 620% increase in Black Friday-themed phishing in the weeks before the 2025 sale, and Kaspersky recorded more than 6 million attempts to reach phishing pages targeting shops, payment systems and banks between January and October 2025. The volume peaks in the last two weeks of November.

What is the most common Black Friday scam?

Fake delivery notifications by SMS and email. They work because almost everyone is expecting a parcel.

Should employees be allowed to shop on work devices?

Most organizations allow it. The practical rule is: fine, but never with the work email address or work password, and never by installing extensions. If you want to be stricter, a web filter that blocks newly registered domains does more than a policy.

How do I know if a webshop is fake?

Check the domain age (a WHOIS lookup takes ten seconds), look for a physical address and chamber of commerce number, and be suspicious of shops that only accept bank transfer. Prices far below every other retailer are the biggest red flag.

Want to know how your team would do? Our free cyber security quiz has a round on exactly these scenarios.