Archive · 31 Aug 2026
Festive Online Sales Bring Rising Scams and Tracking Concerns
Festive sales make many people shop online quickly because they do not want to miss discounts.
Scammers take advantage of this rush by making fake websites, apps and payment links.
Some messages may pretend to come from delivery companies or sellers.
Clicking these links can expose passwords, card details or personal information.
Fake websites may have strange URLs, poor spelling or unusual permission requests.
Online stores also collect information about devices, clicks and browsing habits to show targeted advertisements and offers.
This can make discounts follow shoppers around the internet.
People and businesses both need to take steps to make online shopping safer.
Festive discounts increase online-shopping activity while creating more opportunities for phishing, fake websites, payment scams and social engineering.
Scammers may use lookalike domains, cloned apps, fraudulent links, payment-page skimming and malicious software to target rushed shoppers.
E-commerce platforms use automated systems to monitor prices, inventory, competitors, customer sentiment and consumer behavior.
Tracking can include device details, click patterns, browsing activity and targeted advertising across websites and social media.
Experts advise checking URLs, avoiding unsolicited links and suspicious discounts, using multi-factor authentication and paying through trusted channels.
- Who
- Online shoppers, e-commerce platforms, scammers and cybersecurity experts cited in the article.
- What
- Festive online sales are increasing both shopping-scam risks and concerns about e-commerce data tracking.
- When
- During the festive sales season and major discount events.
- Where
- Across online retail websites, applications, payment pages, email, SMS, social media and messaging platforms.
- Why
- Shopping urgency and increased digital transactions make consumers more vulnerable, while retailers use data to personalize offers and monitor markets.
Privacy and consumer protection concerns
Retailer and security rationale
Cross-platform tracking
Privacy and consumer protection concerns
Consumers may feel monitored when device information, clicks and browsing activity are used to follow preferences across websites and social media.
Retailer and security rationale
Retailers use automated data collection for market research, price checks, sentiment monitoring and more targeted products, advertising and discounts.
Responsibility for fraud prevention
Privacy and consumer protection concerns
Consumers should not be expected to identify every sophisticated fake site or payment link, particularly during high-pressure sales periods.
Retailer and security rationale
Experts say consumers and businesses must share responsibility: shoppers should remain cautious while companies secure infrastructure and respond to impersonation.
Sale-period urgency
Privacy and consumer protection concerns
Limited-time offers and low-stock warnings can pressure shoppers into clicking unfamiliar links or overlooking payment details.
Retailer and security rationale
Retailers use festive promotions to increase sales, while security professionals recommend stronger monitoring and authentication to manage the associated risks.
- Main scam methods
- Lookalike domains, fake shopping websites and apps, phishing, fraudulent payment links, payment-page skimming and social engineering.
- Potential stolen information
- Login credentials, payment information, personal data and device access.
- Retailer data uses
- Price checks, inventory monitoring, competitor research, customer-sentiment analysis and targeted recommendations.
- Tracking examples
- Device specifications, operating system, screen resolution, click patterns, browsing activity and social-media interactions.
- Reported AliExpress finding
- Developer Matt Callaghan said he found obfuscated scripts examining device and browser signals while investigating a Bluetooth-headphone issue.
- Recommended consumer protections
- Verify URLs, avoid unsolicited links, use secure payment gateways, enable multi-factor authentication and question unusually large discounts.
- Recommended business protections
- Use tokenized payments, transaction monitoring, tighter vendor and API controls, fraudulent-domain monitoring and incident-response plans.