Black Friday falls on 27 November this year and Cyber Monday on 30 November. For a fraud team, though, those two dates are only the peak of a much longer window. Promotions start in late October and run into early December and every week of it brings more logins, more new payees and more alerts.
Nor is there one calendar. Europe, South Africa and Brazil follow the US states. Mexico has its own event, El Buen Fin, which runs from Friday 13 to Tuesday 17 November. And the concentration is real: in South Africa, November accounted for 45.9% of combined November–December retail sales in 2025, according to Stats SA, up from 44.6% in 2023.
The hidden vulnerabilities of trusted accounts
Fraud does not always originate from newly created accounts or suspicious first-time transactions. An inactive account suddenly returning during Black Friday, for example, could belong to a customer waiting for a particular offer. Equally, it could be an account accessed by someone using stolen credentials.
This makes it difficult to distinguish legitimate behaviour from fraudulent activity based on individual signals alone.
TransUnion’s Top Fraud Trends Report, published in October 2026, found that 81% of suspected digital fraud worldwide in the first half of 2026 occurred in interactions with existing customers, not new ones. In financial services specifically, the report found that transaction-related activity carries even greater risk than account creation. And the pressure peaks when traffic does: Visa blocked 140% more suspected fraud across Europe on Black Friday 2025 than on Black Friday 2024, and 40% more than on a regular Friday a week earlier.
Account takeover (ATO) is where this hurts most, and it is concentrated in the exactly the accounts Black Friday puts under pressure. In the UK, Cifas reported that takeovers of online retail accounts rose 84% and of card accounts 59% in the first half of 2026 compared with a year earlier.
Taking over an account does not always require stealing a password. Sometimes it is enough to ask the customer for the code meant to protect it. Two weeks before Black Friday 2025, Google filed a lawsuit against the operators of Lighthouse, a phishing-as-a-service kit it says has harmed more than a million victims in 120 countries. Fake delivery texts and fake online shops, some promoted through search ads, collected victims’ card details. The site then tried to add the card to a mobile wallet on a device the fraudsters controlled. When the bank sent a one-time code to confirm that enrolment, the page told the victim it was a routine purchase check and asked them to type it in. The bank’s own authentication ended up approving the fraudster. The fraudsters then typically waited 7 to 10 days before using the wallets, long enough for the fraud to land in the middle of the peak shopping weeks.
In an account takeover, an attacker gains control of an existing account, usually with stolen credentials. That makes it a different problem from new account fraud, covered in New Account Fraud and How Identity Verification Stops It.
How peak season takeovers start
Account takeover rarely begins at the bank. It begins weeks earlier, in an inbox, a text message or a search result. Europol’s IOCTA 2026 describes online fraud becoming faster, more industrialised and harder to trace, with generative AI personalising social engineering and agentic AI starting to automate parts of the process. It also notes that the prominence of phishing and smishing is a direct adaptation to two-factor authentication: if criminals cannot break the second factor, they persuade the customer to hand it over.
Black Friday gives every one of these techniques a believable pretext.
The table below shows the most common routes into Account Takeover(ATO) during peak season.
| Fraud type | Peak-season pretext | What it seems like | Where it leads |
| Phishing | Fake order confirmations, payment failures and “exclusive deal” emails | A correct login from a new device, often within hours of the lure | Account takeover, card details reused elsewhere |
| Smishing | Delivery notices, customs fees, “unusual charge” alerts sent in bulk from SIM farms or SMS blasters | Passcodes entered on fake pages, then a valid session the customer did not start | Account takeover, new payees, wallet enrolment |
| SIM swap | A number ported or reissued just before the attack | SMS passcodes approved on a device the customer never used | Takeover of accounts protected by SMS step-up |
| Infostealers and credential stuffing | Credentials stolen months earlier, tested in bulk when traffic is high | Spikes in failed logins, then successful ones from residential proxies | Account takeover at scale |
Why identity verification must extend beyond onboarding
Most institutions verify identity thoroughly once, when the account is opened. After that, each login is judged mainly on whether the credentials are correct. An attacker with stolen credentials walks straight past every control that applied at onboarding.
What gives them away is rarely the login itself, but what surrounds it: a device the customer has never used, a payee added minutes after a password reset, a high-value purchase on a card that has been dormant for months, typing and navigation that do not match the customer’s history. That is why verification cannot be a one-off event. It has to keep asking whether the person in the session is still the person who was verified.
This is where behavioural biometrics helps. By analysing how each customer interacts with a service, including typing rhythm, touchscreen gestures and navigation patterns, a bank can learn what normal looks like for that person. Unlike credentials, behaviour is hard to steal or share. Patterns vary with device and circumstances, but clear deviations flag sessions worth a closer look, without adding a step for everyone else.
The objective is to make security proportionate to risk. Routine sessions stay seamless. Stronger verification is reserved for the moments when several signals together suggest the account may no longer be in its owner’s hands.
Stop the attacker, not the customer
Every row in the table above ends the same way: credentials stolen elsewhere, used inside an account the institution already trusts. Controls that judge each login in isolation will keep approving those sessions, because on paper nothing is wrong.
The institutions that handle peak season best stop asking only whether the credentials are correct and start asking whether the session still matches the customer they verified. That is the shift behind continuous identity verification: treating identity as something to reconfirm at the moments that matter, rather than a box ticked at onboarding.
The goal is not to challenge customers more often. It is to know when the assumptions behind a trusted account no longer hold, so you can stop the attacker without stopping the customer.
Frequently asked questions
The most common are phishing and smishing (fake order confirmations, delivery notices and “unusual charge” alerts), vishing calls impersonating a bank’s fraud team, fake shops promoted through online ads, SIM swap, and credential stuffing with passwords stolen earlier. For banks and payment providers, these usually end in account takeover, card-not-present fraud on compromised cards or authorised payment scams in which the genuine customer is persuaded to approve the transaction.
The increase in genuine customer activity during peak shopping periods can make suspicious behaviour harder to distinguish. Logins from unfamiliar devices, unusual purchasing patterns or changes to account details may be legitimate, making it more difficult for businesses to identify compromised accounts using isolated signals.
Not on its own. In an account takeover the attacker usually has the correct credentials, so the login looks valid. What gives them away is the context: the device, the behaviour and the changes they make once inside.
