Cybercrime is prevalent every day of the year; however, certain days will cause a spike in activity. One of these is Black Friday. The main cause is the high amount of traffic that websites receive and the volume of marketing that companies will produce in an attempt to persuade customers to make a purchase.
Customers overlooking the fact they are being directly emailed by a company, or the increased chance that they will make a purchase, allows cyber criminals to exploit a lull in a person’s guard when compared to the average scam attempt.
Cybercriminals are likely to employ artificial intelligence (AI) tools like large language models (LLMs) to create more realistic scam emails, phoney advertisements, and fake websites, according to a warning from the National Cyber Security Centre (NCSC).
The warning comes as 72% of British citizens are concerned that emerging technology, such as AI, may make it simpler for criminals to commit online fraud, according to new data from Revealing Reality/Yonder.
Phishing attacks
In the lead-up to previous Black Fridays, there have been a notable increase in phishing attacks that imitated e-payment pages. From September 2021 to October 2021 cyber security researchers found that the overall number of financial phishing attacks masquerading as e-payment systems more than doubled, signifying a 208% rise. Other sources have stated an increase of 237% phishing emails relating to Black Friday over the first two weeks of November 2023 compared to the previous two periods in October and September.
Researchers have examined which well-known websites were used as bait to disseminate phishing pages. Amazon was the most popular lure, based on the overall number of phishing attempts utilising its name. eBay was the second most popular platform for most of 2021, followed by Alibaba and Mercado Libre.
Figure.1 Graph showing unique phishing sites between q3 2013 to q3 2022 (Source: weforum.com)
DDoS attacks
Due to the large spike in web traffic between Black Friday and Cyber Monday, businesses must prioritise Distributed Denial of Service (DDoS) protection. A DDoS attack is a deliberate effort to overwhelm servers with fictitious traffic during this period due to the increased strain on them, successfully disrupting services. Cybercriminals sometimes see these shopping occasions as lucrative chances to extort companies or do harm. Due to the competitive nature and urgency of these sales, any interruption could result in immediate and substantial losses.
Competitors may even encourage DDoS attacks as a means of sabotaging their rivals by taking them offline on the busiest shopping days of the year.
Best practices to stay safe
The best practice to stay safe as a customer is to thoroughly check the website you are connecting to. Make sure that the URLs are correct, that they have a security certificate and the legitimacy of any address whenever a payment is requested. If you’ve received an email, check the email address as well as any links sent, and do not open any attachments.
As an organisation, you should have your security on a heightened alert. Ensure that your intrusion prevention systems are operational, and you have a disaster response plan in place.
Summary
Cybercriminals are using AI tools to create realistic scam emails, phoney advertisements, and fake websites, and phishing attacks have increased significantly. 72% of British citizens are concerned that AI may make it easier for criminals to commit online fraud. DDoS attacks are also a concern due to the large spike in web traffic between Black Friday and Cyber Monday to stay safe, customers should double-check websites, verify URLs, have a security certificate, and double-check addresses. Organisations should have heightened security alerts, intrusion prevention systems, intrusion detection systems, and a disaster response plan in place.