How to Spot and Avoid Black Friday Shopping Scams in 2026

Black Friday 2026 lands on November 27, and the surge of deal emails, texts and social ads that comes with it is exactly what scammers wait for all year. The fastest way to shop safely: pay by credit card (or a virtual card number) instead of debit, gift cards or crypto; type retailer URLs in yourself instead of tapping links in texts, emails or QR codes; and verify any "too good to be true" deal by searching the seller's name alongside the word "scam" before you check out. The sections below walk through the specific scams making the rounds this season, how to spot each one, and exactly what to do if you've already handed over money or card details.

Fake shopping sites and lookalike domains

The most common Black Friday scam is still the simplest one: a website built to look like a real retailer, often promoted through a social media ad that impersonates the brand. The Federal Trade Commission warns that scammers run ads for brand-name products at suspiciously low prices, and the link in the ad leads to a site that either sends a counterfeit item, something that doesn't match the ad at all, or nothing at all. The Better Business Bureau reports that online purchase scams made up 28.4% of all scams reported to its Scam Tracker in 2025, making them the third-riskiest scam category it tracks — and price was the single biggest reason victims clicked "buy."

Many of these fake storefronts use a domain that's one character off from the real retailer's — a swapped letter, an extra hyphen, or a different top-level domain like ".shop" or ".biz" instead of ".com". This technique has a name, and it's worth understanding on its own; see our breakdown of how lookalike domains are used to scam shoppers for the mechanics behind it.

Warning signs the BBB and FTC both flag:

• The URL is slightly misspelled, uses an unusual domain ending, or doesn't match the brand you searched for
• No HTTPS padlock in the address bar, or the checkout page drops to plain HTTP
• No physical address, phone number, or working contact page
• Poor grammar or spelling in product descriptions
• A domain that's only a few weeks or months old (check this with any free WHOIS lookup)
• A "card declined" message during checkout, which the BBB notes can be part of a card-skimming scheme designed to get you to re-enter your number

Phishing emails and texts about "order problems" or "deals"

Expect a sharp rise in emails and texts claiming there's a problem with an order you never placed, or offering a deal that requires you to "verify your account" first. The FTC's guidance is blunt: never pay a seller who insists you can only pay by gift card, wire transfer, a payment app like Zelle or Cash App, or cryptocurrency — that's "probably a scam," because those payment types can't be reversed or disputed. The same logic applies to any urgent email or text that asks you to click a link to "confirm," "fix," or "verify" an order.

Before clicking anything in an unsolicited message:

• Hover over (don't tap) links to see the actual destination URL
• Go to the retailer's app or site directly, rather than through the message, to check your real order history
• Treat any message that creates urgency ("your order will be cancelled in 1 hour") as a red flag
• Remember that legitimate retailers never ask you to pay a "release fee" or "customs fee" by gift card to receive an order you already paid for

Voice-based versions of this same pressure tactic are also common during the holidays — a caller posing as a bank or retailer fraud department. If you get one of those calls, our guide to how voice phishing (vishing) scams work and how to stop them covers how to tell a real fraud-department call from a fake one.

Fake delivery-tracking texts (smishing)

With millions of real packages moving in late November, a fake "delivery problem" text blends right in. The FBI's Cleveland field office, in a 2025 holiday-season advisory, listed phishing-based fake delivery notices alongside non-delivery scams and fraudulent gift-card offers as the recurring holiday threats it sees reported. The FTC's separate alert on "brushing" scams — where you receive a package you never ordered — notes that the enclosed note often asks you to scan a QR code to "find out who sent it" or "process a return." Scanning takes you to a phishing site built to steal your card number, username, or password, not to any real carrier.

To protect yourself from delivery smishing:

• Never tap a tracking link in a text or email you weren't expecting — go to the carrier's official site or app and enter the tracking number yourself
• Know that carriers like UPS, FedEx and USPS do not text asking for a fee, your Social Security number, or payment-app transfer to release a package
• If you receive a package you didn't order, you're legally allowed to keep it as a gift — you don't need to respond to any note inside it or pay anything
• If you already clicked a bad tracking link and entered a password, change it immediately and turn on two-factor authentication

Report suspicious delivery texts and any financial loss to the FBI's Internet Crime Complaint Center at IC3.gov; the Cleveland field office advises filing within 72 hours for the best chance of recovering funds.

Counterfeit goods on marketplaces and deal sites

Not every scam site steals your money outright — some simply ship a fake. STOPfakes.gov, the U.S. government's interagency site for intellectual-property enforcement, recommends buying only from authorized retailers (brands typically list these on their own sites), and treating a price with no sales tax charged as a red flag, since counterfeit sellers often skip taxes because they aren't reporting the sale. It also suggests asking any third-party seller directly where their stock came from — a legitimate reseller can answer; a counterfeit operation usually can't or won't.

Once a package arrives, STOPfakes.gov advises checking for:

• Missing or broken safety seals, missing warranty cards, or packaging that looks slightly "off" compared to photos on the brand's own site
• Serial numbers that don't verify through the manufacturer's official lookup tool (useful for electronics especially)
• A total price that seems to skip sales tax or standard fees entirely

If a counterfeit does show up, dispute the charge with your card issuer, contact the marketplace or platform where you bought it, and report the listing to the brand directly.

Malicious QR codes in ads and flyers

QR codes went mainstream during the pandemic and scammers have followed the traffic ever since. The FTC's brushing-scam alert specifically calls out QR codes included with unexpected packages, but the same risk applies to QR codes on parking meters, fake "doorbuster" flyers, pop-up ads, and even stickers placed over a legitimate code in a store. Scanning an untrusted QR code can send you to a convincing fake checkout page, or in some cases trigger a malicious app download.

Before scanning any QR code tied to a "deal":

• Check where the code actually points before you tap through — most phone cameras show a URL preview before opening it
• Be suspicious of any QR code that appears on a flyer, email, or unsolicited text rather than on an item you're already holding at checkout
• If the destination asks for a card number immediately with no product page in between, close it
• When in doubt, open the retailer's app or type its known URL instead of scanning anything

Black Friday scams at a glance

The safest way to pay: credit vs. debit vs. virtual cards

Payment method is the single biggest factor in whether you get your money back. The BBB's own research found that shoppers who paid by credit card were less likely to lose money than those who used other payment types, and the FTC notes that credit cards carry federal dispute rights that let you withhold payment for goods you ordered but never received. Debit cards draw directly from your bank account and generally carry weaker chargeback protections than credit cards.

Where available, a virtual card number is the strongest option for one-off purchases from a site you haven't used before: it's a temporary, single-merchant number generated by your card issuer or digital wallet that masks your real card number, so a breach at that retailer doesn't expose your actual account. Visa's own guidance on safe online shopping also points to Visa Secure (the behind-the-scenes verification layer many merchants use) and its Zero Liability policy for unauthorized card transactions, while advising cardholders to monitor statements and turn on purchase alerts so suspicious charges surface immediately rather than at month's end.

Practical payment rules for this Black Friday:

• Use a credit card or a virtual/single-use card number for any new or unfamiliar retailer
• Never agree to pay a stranger-run "sale" via gift card, wire transfer, Zelle, Cash App, or crypto
• Turn on transaction alerts so you see a charge the moment it posts
• Avoid saving full card numbers on retailer accounts you don't plan to shop with again

How to verify a retailer is legitimate before you buy

A few minutes of checking before checkout catches most of the scams above. PayPal's own guidance on spotting online shopping scams recommends confirming a seller has a real, published physical address and phone number, checking prior customer reviews, and looking at the store's social media activity — fake stores, PayPal notes, often disappear within days or weeks of launching. PayPal also flags any seller who asks you to send money as a "donation" through PayPal rather than a standard purchase, since that routes around buyer protection entirely.

A fast pre-purchase checklist:

• Search the exact seller/site name plus "review," "complaint," or "scam"
• Check the site's BBB Business Profile at BBB.org if one exists
• Confirm the URL matches the real brand exactly — no extra words, hyphens, or unusual endings
• Look for a working return policy, a real customer service contact, and consistent spelling/grammar throughout the site
• Be extra cautious with the highest-demand items of the season (electronics, popular toys, sneakers) and with pet, clothing, and vehicle listings, all categories the BBB flags as frequently targeted

If you're also shopping for a phone deal this week, it's worth cross-checking advertised prices against a source tracking real offers; see what Black Friday 2026 phone deals are actually live right now before trusting a "limited time" price you saw in an ad.

What to do if you've already been scammed

If you've already paid a fake seller, clicked a bad delivery link, or entered your card details on a lookalike site, move through these steps right away:

1. Contact your card issuer or bank immediately to dispute the charge and request a new card number. The sooner you report it, the stronger your dispute rights under federal law.
2. Change any password you entered on the fake site or after scanning a malicious QR code, and turn on two-factor authentication on that account and any others using the same password.
3. Contact the seller first if it's a real marketplace account gone wrong, per FTC guidance — then escalate to your payment provider's dispute process if the seller won't help.
4. Report it to the FTC at ReportFraud.ftc.gov, which feeds its data to law enforcement nationwide.
5. Report it to the FBI's Internet Crime Complaint Center at IC3.gov, ideally within 72 hours of the loss, which the FBI says gives the best chance of fund recovery.
6. File a report with the BBB's Scam Tracker at BBB.org so other shoppers are warned about the same seller or site.
7. Check your credit reports for new accounts or inquiries you don't recognize if you suspect your personal information (not just a card number) was exposed.

None of this requires admitting defeat quietly. Reported scams are what let the FTC, FBI, and BBB track and shut down repeat offenders before next season — and a fast card dispute is often enough to get your money back in full.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage