Black Friday Scams 2026: Spot a Fake Deal Before You Pay
By Thomas Lovas Lokoy · Published October 23, 2026 — researched and drafted with AI assistance from published sources; edited and published by NorwegianSpark SA.
The most reliable way to avoid a Black Friday scam is to check the seller before you check the price, and to pay with a credit card rather than anything a seller asks you to use instead. Most shopping fraud is not clever. It works because a deal looks good, the clock is ticking, and nobody stops to search the shop's name. Black Friday is on 27 November 2026 and Cyber Monday on 30 November, so the pressure peaks in the next five weeks.
| Red flag | Why it matters | What to do |
|---|---|---|
| A brand-name product at an unusually deep discount, found through a social media ad | The FTC warns that scammers impersonate real brands and run ads that lead to fake sites | Go to the brand's site yourself instead of clicking the ad |
| The seller wants gift cards, a wire transfer, a payment app or crypto | The FTC calls these methods a sign of a scam because the money is hard to get back | Do not pay. Leave |
| No reviews, or only glowing ones | The FTC notes some reviews and ratings are fake or misleading | Search the shop name with the words review, complaint and scam |
| A padlock in the address bar | It only means the connection is encrypted; scammers can encrypt sites too | Treat it as neutral, not as proof |
| A delivery text asking you to tap a link or pay a fee | A classic way to harvest card details during the holidays | Track parcels from the retailer's own site or app |
How big is the problem?
The best public measure is the FBI's Internet Crime Complaint Center. Its 2025 annual report records 56,478 complaints of non-payment or non-delivery fraud, with reported losses of 503,373,587 USD. The year before, the same category drew 49,572 complaints and 785,436,888 USD in reported losses. The IC3 defines non-delivery as payment sent for goods or services that are never received, or are of lesser quality.
Across all crime types, the report says reported losses in 2025 surpassed 20 billion USD. These are complaints people chose to file, so the real figures are higher; what the numbers do show is that buying something and never receiving it is one of the most common ways people lose money online.
The fake shop: what it looks like in 2026
The FTC's holiday alert for the 2025 season put it bluntly: scammers are everywhere online, "ESPECIALLY on social media". The pattern it describes is consistent. An ad impersonates a real company, shows brand-name goods at a low price, and links to a site that sends a counterfeit, a different item, or nothing at all.
Two habits defeat most of these:
- Search before you buy. The FTC's advice is to search the seller's name and the web address the ad sent you to, together with words like review, complaint or scam. A shop that appeared last month and has no history is a reason to stop.
- Navigate, do not click. If an ad says a well-known brand has a big discount, open the brand's own website or app in a new tab and look for the same offer. If it is not there, the ad was not the brand.
Be wary of a web address that is almost right: an extra word, a hyphen, an unusual ending. A padlock does not help here. The FTC's online shopping guidance notes that https means the site encrypts your information, but that it does not prove the site is legitimate.
Pay in a way you can undo
How you pay decides whether a mistake is recoverable.
- Credit card first. The FTC says paying by credit card gives you the strongest protection. If you are charged twice, billed for something you never received, or sent the wrong or a defective item, you can dispute the charge. Call your card issuer straight away and follow up in writing; the FTC notes that the letter must reach the card company within 60 days of the date it mailed the first bill showing the error.
- Never gift cards, wires, payment apps or crypto for a shop. The FTC says to never buy from a seller that insists on gift cards, wire transfers through companies such as Western Union or MoneyGram, payment apps or cryptocurrency, because those make your money hard to recover.
- Keep the paperwork. Save receipts, order numbers and confirmation emails. The FTC also notes that sellers must ship within the time they state, or offer you a refund.
A virtual or single-use card number, where your bank offers one, adds a further layer: if the shop turns out to be fake, the number it holds is worthless.
Delivery texts and parcels you did not order
The holiday season is also peak season for fake delivery messages. A text claims a parcel is held and asks you to tap a link to pay a small redelivery fee. The fee is not the point; the card details are. Our guide to smishing and scam texts covers the variants. The simple rule is to track deliveries only from the retailer's own app or order page.
The opposite scam is a parcel that arrives without being ordered. The FTC described this "brushing" pattern in August 2026: a seller sends an item in your name and uses it to post fake reviews. Its advice:
- Change the passwords on your online shopping accounts, in case they were compromised, and tell the marketplace if the item came through one.
- Check your credit reports for free at AnnualCreditReport.com and watch for signs of identity theft. A credit freeze is the stronger step if you see anything odd.
- Do not scan a QR code included with the parcel that offers to reveal the sender or process a return. It may lead to a phishing site.
- You do not have to return or pay for it. The FTC notes that the law says you do not need to return things you did not order.
A two-minute checklist before you pay
- Did you reach this shop by typing the brand's address or using its app, rather than through an ad or a text?
- Does a search for the shop's name with the word scam come back clean?
- Is the price believable compared with the same product at two retailers you know?
- Are you paying by credit card, or another method that lets you dispute the charge?
- Have you saved the order confirmation?
If you clicked something and then typed your card number or a password, the steps in clicked a phishing link apply: call the card issuer, change the password, and turn on two-factor authentication. For the wider pattern of fake messages, see how to spot phishing.
Where security software fits
A security suite with web protection can block known malicious sites and flag phishing pages, which is a useful second line when a fake shop is already on a blocklist. It cannot tell you whether a brand-new shop will deliver, and it cannot get your money back. The checks above do the first job and the card dispute does the second.
On detection, free and paid products from the major vendors sit close together: in AV-TEST's August 2026 Windows 11 round, Avast Free Antivirus scored 18 of 18 points and earned AV-TEST's TOP PRODUCT award. The differences between tiers are in extras like web and email protection, which our free vs paid antivirus guide sets out.
If it already happened
Contact your card issuer or bank first; speed matters. Then report it. In the US, the FTC takes reports at ReportFraud.ftc.gov and the FBI at ic3.gov. Report the fake ad to the platform that showed it, too. Shopping scams rely on volume, and every report helps take a site down sooner. This is general guidance, not legal or financial advice for your situation.
Frequently Asked Questions
When is Black Friday 2026?
How do I know if an online shop is fake?
What is the safest way to pay on Black Friday?
How common are non-delivery scams?
I received a package I did not order. What should I do?
Affiliate disclosure
This article contains affiliate links. If you purchase through them, CyberTechVault earns a commission at no extra cost to you. Our assessments are based on vendors' published documentation, independent lab results and security disclosures — not on hands-on testing by us. Affiliate relationships never decide what we recommend.
Full disclosure: /affiliate-disclosure.
Sources
Factual claims above were checked against these primary sources. Verify directly on the source for anything time-sensitive before relying on it.
Continue reading
privacy
ISO/IEC 27001 Explained: Annex A, Certification and How to Start
What ISO/IEC 27001 is, who needs it, what the 2022 revision changed, how the 93 Annex A controls are organised, how certification works, how it compares with NIST CSF and SOC 2, and how a small business starts.
vpn
PureVPN Review 2026: Is PureVPN Safe and Legit?
PureVPN is a legitimate, long-running VPN with a big server network and an "always-on" audit claim. It also has a 2017 logging case that still matters. What its own pages say, and who it suits.
guides
Bitdefender Review 2026: Lab Test Results, Pros and Cons
Bitdefender Total Security 2026 review: 99.5% in AV-Comparatives' real-world test, 6/6/6 at AV-TEST, Safepay, VPN limits, pros, cons and who should skip it.
