Black Friday and Cyber Monday 2026: a fraud prevention playbook for ecommerce

Businesses calibrate their fraud controls around normal conditions. But for four days at the end of November, almost nothing is normal. Order volumes jump, first-time buyers make up a much larger share of traffic, and checkout speeds up as customers race against countdown timers and limited-time offers.

During this period, the velocity rules that protect onboarding and checkout flows can start working against the business. Behaviors that would normally look suspicious become common, and genuine customers are more likely to be declined.

Fraudsters know this too. Visa blocked 140% more suspected fraud across Europe on Black Friday 2025 than on Black Friday 2024, and 40% more than on the previous Friday. Between Black Friday and Cyber Monday, review queues fill up, thresholds come under pressure, and fraud teams are expected to keep approval rates high despite the increase in risk.

The attacks that surface during the peak weekend also rarely begin there. Fraudsters can spend the preceding weeks testing accounts, identities, cards, and payment methods while volumes are lower and unusual activity is easier to miss.

That is why Black Friday fraud prevention should not start on Black Friday. The controls, signals, and strategies needed for peak season should be tested and ready well before the first sale goes live.

Why peak season breaks controls that work the rest of the year

Three things change at the same time:

• Volume. A rule that flags five orders from the same IP within an hour may work perfectly well in March. On Black Friday, the same rule can flag a household sharing a connection or a corporate network serving hundreds of employees.
• Mix. First-time buyers can become a much larger share of orders, sometimes the majority. Suddenly, every signal that relies on account history becomes unavailable for a large share of your traffic, precisely when you need it most.
• Tolerance. During peak periods, commercial teams monitor approval rates almost in real time. A false positive rate that might be acceptable in a quarterly review can become an escalation within minutes. The common response is to loosen thresholds across the board, but this restores approvals by weakening controls for everyone, including fraudsters.

What holds up under this pressure is a rule set built on signals that are available from the first interaction. Order history, transaction patterns, and account age are valuable, but they cannot tell you much about a customer who arrived from a price comparison site twelve seconds ago and has never bought from you before.

For first-time buyers, fraud decisions need to start with what is already available: the digital signals behind the email address, phone number, IP address, and device they provide or connect from.

Six attacks that concentrate around peak weekend

1. Bots targeting constrained inventory

Retail bots may be associated with sneaker drops, but the same techniques are used against almost any product with limited availability, from console restocks and event tickets to heavily discounted electronics.

Bots can hold carts, repeatedly attempt purchases, and clear inventory faster than genuine shoppers. Customers are left with an out-of-stock page while the same products appear on resale platforms shortly afterward.

Rate limiting alone is often not enough. Bot operators can distribute requests across residential proxy networks and rotate device fingerprints between attempts. Detection therefore needs to look beyond request volume and consider the wider session: how the user arrived, whether the interaction resembles normal browser behavior, and whether the same characteristics appear across supposedly unrelated accounts.

2. Card testing against your checkout

Fraudsters use ecommerce checkouts to determine whether stolen card details are still valid, often by attempting small transactions before using the card elsewhere. Online card fraud is already the largest source of unauthorized payment fraud losses in the UK: remote purchase card fraud losses rose to £423.5 million in 2025, with cases up 13% to 3.2 million, according to UK Finance.

Black Friday and Cyber Monday provide useful cover. Transaction volumes are unusually high, suspicious patterns are harder to distinguish from legitimate spikes, and some merchants may already have relaxed their controls to protect conversion.

The impact can extend beyond the fraudulent transactions themselves. Authorization rates fall, issuers may become more cautious about merchant traffic, and sustained activity can create problems with acquirers.

Teams should watch for concentrations around specific BINs, unusual increases in low-value transactions, repeated payment attempts, and a growing gap between attempted and successful payments: the typical footprint of payment fraud through card testing.

3. Account takeover on saved payment methods

Stored cards, loyalty balances, and accumulated rewards make established customer accounts particularly valuable during peak season.

Credential stuffing attacks use credentials exposed in previous breaches to gain access to these accounts. Once an attacker gets in, monetization can happen quickly. A delivery address is changed, express shipping is selected, and a purchase is made using a payment method already stored on the account.

The strongest indicators of account takeover may appear before the order itself. A new device, an unfamiliar network, unusual login behavior, or sensitive account details changed shortly before checkout can reveal the takeover before the payment is attempted.

4. Gift card draining and enumeration

Gift card activity rises sharply during the holiday period, making balance-check and redemption systems attractive targets.

Attackers can automate attempts against gift card numbers and PIN combinations to identify cards with available balances and drain them before the legitimate owner has a chance to use them. Gift cards can also be purchased using stolen payment methods because they convert compromised funds into transferable value quickly and do not require the same fulfillment process as physical goods.

Balance-check and redemption endpoints should therefore be treated as risk-sensitive surfaces, not as secondary features. The same attention given to login and checkout should extend to the systems that expose or transfer stored value. Trustfull's guide to gift card fraud covers these attacks in more detail.

5. Promo, referral, and first-order discount abuse

Peak-season promotions are designed to attract new customers. The easier an offer is to claim, however, the easier it can be to abuse at scale.

One person can create dozens or hundreds of accounts using disposable email addresses, virtual phone numbers, and other variations of the same underlying identity, claiming a first-order or referral incentive repeatedly.

Individual accounts may look harmless. The pattern becomes visible when they are analyzed together. Accounts that appear unrelated may share device characteristics, network infrastructure, phone attributes, email patterns, or other digital signals.

6. Mule-linked payouts and organized refund abuse

Not every peak-season return is fraud. High order volumes naturally lead to more returns, and some customers will make full use of generous refund policies. Those are primarily commercial and policy questions.

The fraud problem begins when organized actors exploit these processes.

Refund-as-a-service schemes can fabricate non-delivery claims on behalf of customers. Compromised accounts can have payout details changed shortly before a refund request. The same delivery addresses can also appear repeatedly across accounts that otherwise have no apparent relationship, acting as drop points for fraudulent orders.

These return and refund fraud attacks are easier to identify when the business can connect the identities, devices, networks, and account attributes involved rather than evaluating each refund or order in isolation.

What to fix before peak weekend

Rebaseline thresholds against last year's peak, not last month's average

Rules designed around ordinary traffic should not be assumed to work during Black Friday.

Take traffic from the equivalent peak period last year and replay your velocity, geography, device, and identity rules against it. Look at how many would have triggered on legitimate customers and where thresholds would have created unnecessary declines.

This gives fraud teams time to distinguish controls that genuinely identify risk from those that simply react to higher volume.

The objective is not to make every rule more permissive. It is to understand which thresholds stop being meaningful when customer behavior changes.

Move the decision earlier

Checkout is one of the worst places to discover that you know almost nothing about a customer.

By that point, the customer expects an immediate decision and any additional friction can directly affect conversion. Earlier stages such as signup, account creation, and login provide an opportunity to assess risk before that pressure exists.

An email address with little or inconsistent digital history, a phone number whose attributes do not match the information provided, an unusual IP connection, or a session showing signs of automation can all provide useful context before a transaction takes place.

Moving part of the risk assessment earlier reduces the amount of work that has to happen at checkout when traffic is at its highest.

Build the peak rule set now and keep it ready

Peak-season controls should be prepared before peak-season traffic arrives.

Build the rules you expect to use and test them against historical traffic. Measure their effect on both fraud detection and genuine customer approvals. Make sure changes can be activated, monitored, and rolled back without requiring teams to redesign the strategy during the event itself.

Rules written under pressure are harder to test and harder to explain. Versioning, ownership, and rollback procedures become especially important when small changes can affect thousands of transactions in a short period.

Agree on review capacity and the escalation path

Manual review capacity is finite, and Black Friday is not the time to discover its limit.

Teams should know how many cases can realistically be reviewed per hour, what happens when the queue exceeds that capacity, and who has the authority to change a threshold.

Fraud and commercial teams should also agree in advance on the metrics that trigger an escalation and which controls can be adjusted first.

This prevents a predictable pattern during peak: queues rise, approval rates fall, pressure increases, and controls are loosened without enough time to understand which change will actually solve the problem.

What to watch across the four days

Read authorization rate and BIN concentration together

A falling authorization rate is important, but it does not explain what is happening on its own.

During peak periods, issuers may become more cautious simply because transaction volumes and unusual purchasing patterns increase. A decline in authorization rate spread across many BINs can therefore look very different from a decline concentrated around a small number of BINs.

Monitoring the two together makes it easier to distinguish a broad change in issuer behavior from concentrated card-testing activity.

Split monitoring between new and returning customers

Aggregate dashboards can hide exactly the pattern fraud teams need to see.

If first-time buyers suddenly represent more than half of traffic, overall metrics will be heavily influenced by a population with no account or transaction history. A surge in risky new accounts can therefore disappear inside a genuine acquisition spike.

Monitor new and returning customers as separate cohorts. Compare approval rates, risk indicators, payment outcomes, and review rates independently rather than assuming the same baseline applies to both groups.

Spend friction where it changes the outcome

Every additional challenge has a conversion cost, and that cost becomes more visible during Black Friday when customers can compare offers across several tabs and retailers.

Friction should therefore follow evidence of risk rather than customer status alone. In Europe, strong customer authentication already does much of this work for card payments: the EBA and ECB found that card fraud was 17 times higher when the payee was outside the EEA, where strong authentication is generally not required, and that fraudsters increasingly target transactions exempt from it.

A payout method changed minutes earlier, a device appearing across supposedly unrelated accounts, an unusual network connection, or identity attributes that do not match can justify an additional verification step. Being a first-time customer, by itself, should not.

Selective friction allows businesses to investigate genuinely risky sessions without forcing the entire peak-season acquisition funnel through additional checks.

What to do in the two weeks after

Label outcomes while the weekend is still fresh

The operational peak may end on Cyber Monday, but the fraud picture will not be complete for weeks.

Chargebacks and disputes linked to peak-season purchases can arrive much later. Tagging orders, cohorts, and rule decisions now makes it possible to connect those later outcomes to the controls that were active when the transaction was approved.

Without that link, teams reach the following October knowing how much they lost but not which decisions produced those losses.

Separate fraud losses from policy and operational losses

Not every loss that appears during peak season belongs to the fraud team.

Separate outcomes into at least three categories: third-party fraud, where someone uses payment details or credentials that do not belong to them; policy loss, where legitimate customers exploit or make extensive use of the rules offered by the merchant; and operational loss, including revenue lost because genuine customers were incorrectly declined.

The distinction matters because each problem requires a different response.

A stricter fraud rule will not fix an overly generous returns policy. In the same way, loosening controls will not solve poor customer segmentation if genuine shoppers are being declined for the wrong reasons.

Apply what you learned before the January sales

The next useful test arrives quickly.

January sales create many of the same conditions at a smaller scale: increased acquisition, promotional activity, unusual purchasing patterns, and pressure on approval rates.

Use that traffic to test the changes identified after Black Friday rather than waiting another year. By then, the team should know which rules generated false positives, which signals identified genuine fraud, and where additional context would have improved the decision.

How Trustfull can help

Peak season exposes a basic limitation of fraud systems that rely heavily on transaction and account history: many of the customers a business needs to assess have neither. Trustfull analyzes signals linked to email addresses, phone numbers, IP addresses, devices, and sessions to help businesses identify suspicious identities and connections without relying solely on previous transactions. During peak season, this supports decisions at several points in the customer journey:

• At signup, digital signals help distinguish genuine first-time customers from promo abuse, coordinated account creation, and mule-linked activity.
• At login, device, network, and behavioral context can surface suspicious access before an attacker reaches stored payment methods or loyalty balances.
• During the session and at checkout, Trustfull Session and digital footprint intelligence give fraud teams context that transaction data alone may not provide, particularly for customers with no previous history.

Selective friction, not more friction

The goal is to have enough information to apply friction selectively during the busiest weekend of the year, keeping genuine customers moving while fraud teams investigate the sessions that actually look risky.

Talk to our team about preparing your peak-season fraud strategy before the next sale goes live.