The first Black Friday email usually lands before the coffee is finished. Deals are the bait; your account is the prize. Between late November and the first week of January, inboxes and search results fill with offers that are too cheap, too urgent, or just slightly off, and the people behind them are rarely interested in the blender you were browsing. They want the card saved in your browser, the loyalty balance on your retail account, or the password you reused in 2019.

None of this is exotic. What changes in December is volume. You are buying more, from more unfamiliar shops, with less attention than usual. That combination is what makes the season profitable for thieves.

Why the holiday rush works in a scammer's favour

Shipping notifications, order confirmations and "your parcel is delayed" messages are normal in December, so a fake one blends into the noise. Fake storefronts are cheap to build and easy to abandon. Meanwhile, lists of leaked email and password pairs from old breaches get dusted off and run against retail logins, because plenty of people still use the same password in more places than they realise.

Add the distraction factor: you are shopping on a phone, in a queue, half watching a film. That is exactly the moment when nobody checks the address bar.

Secure the accounts that actually matter

You do not need to audit every login you own. Start with four categories: your main email, your payment accounts, retail accounts with a saved card, and delivery or marketplace accounts. Email comes first, because it is the reset button for everything else.

• Give each account its own password. A password manager makes this practical. If you remember it, it is probably reused.
• Turn on two-factor authentication wherever it is offered. An authenticator app, a passkey or a hardware key is stronger than a code sent by text, which can be intercepted or SIM-swapped.
• Delete saved cards from shops you order from once a year. Stored payment details are the reason account takeovers are worth the effort.
• Review active sessions in your email and bank settings, and sign out of anything you do not recognise, including old phones and shared computers.

Twenty minutes on those four items does more than any app you could install afterwards.

How to tell a fake storefront from a genuine deal

Deep discounts exist. Impossible ones do not. A current-model phone at 80 percent off, on a site you have never heard of, is not a bargain you found first; it is bait. Run a quick check before you type a card number:

• Read the address bar, not the logo. Look for misspellings, extra words and hyphens jammed into a familiar brand name.
• Check the payment options. Established retailers accept major cards. A shop that only takes bank transfer, cryptocurrency or gift cards is asking for money you cannot claw back.
• Test the contact details. Is there a real address, a working phone number, a returns policy with actual conditions? Copy-pasted policy text and a contact form that goes nowhere are warning signs.
• Look at the reviews. A wall of five-star praise posted on the same day, with no specifics, tells you little. Search the product on a retailer you trust to see what it normally costs.
• Watch the pressure tactics. Countdown timers that reset, "three left in stock" on every item, and a checkout that refuses to show the total until the last step.

Pay with a number that isn't your real one

Virtual cards are the most underused shopping tool available. Your bank or card issuer generates a separate card number tied to your account, and you decide how it behaves: a spending limit, a short expiry, or a number locked to a single merchant. If that number leaks in a breach, there is nothing left to steal.

If your bank does not offer them, digital wallets do similar work. Paying with a wallet means the shop never sees your actual card number, and your phone confirms the transaction before it goes through. Both approaches keep your real details out of a database you cannot audit.

One honest caveat: a virtual card protects the number, not the purchase. If a shop takes your money and never ships, you still need to dispute the charge, so keep the confirmation email and check your issuer's process. For anything involving significant money, your bank is the right place to ask.

Seasonal phishing that looks like routine mail

The messages that catch people are not badly spelled lottery wins. They are delivery updates with a small redelivery fee, order confirmations for purchases you did not make, and "your account has been locked" notices timed to a week when you genuinely are ordering a lot.

The rule is simple: never act on a link in a message about money or delivery. Open the retailer's app or type the address yourself, then check whether the order or the problem actually exists. For gift cards bought from a shop rack, inspect the packaging for signs of tampering and keep the receipt, since drained cards are difficult to trace.

Marketplace scams follow the same pattern. A "buyer" who overpays and asks you to refund the difference, or who wants to move the conversation off the platform, is not a buyer.

Networks, devices, and a five-minute checkout routine

Public Wi-Fi is less dangerous than it once was, because most sites now encrypt traffic, but shared computers are still a bad place to log into a bank. Use your phone's hotspot if you need to buy something while travelling. Keep your browser and operating system updated, and consider a separate browser profile for shopping so your work logins and saved cards stay out of the way.

Then, before you hit pay:

1. Re-read the URL one last time.
2. Check the final total, including shipping and any added fees.
3. Pay with a virtual card or wallet rather than a stored card.
4. Screenshot the confirmation and order number.
5. Decline the "save my card for next time" prompt.
6. Log out if you are not on your own device.

Keep the season about people, not packages

Do the account cleanup once, this week, and it holds for the rest of the year. After that, the habits are small: buy from shops you can verify, pay with a number that expires, and treat every delivery text as a claim rather than a fact.

In January, skim your statements for charges you do not recognise. If something looks wrong, contact your bank straight away and change the password on the affected account, along with any account that shared it. Speed matters more than perfect wording when you report a fraudulent charge. A few minutes now buys you a quieter December, and that is the actual gift.

Photo: https://kaboompics.com/ / Pexels