Six Cyber Threats Facing Retailers This Black Friday, Cyber Monday
Jeffrey Edwards
|Cyber Risks & Threats | July 17, 2024
From Black Friday to Cyber Monday, the retail ‘holiday weekend’ following Thanksgiving represents the largest shopping event of the year, marking a period when many retailers enjoy their strongest sales. Increasingly, this pivotal weekend has shifted online, transforming into a digital shopping spree for both retailers and consumers alike.
While deep discounts still entice customers to visit brick-and-mortar stores, a significant portion of shoppers now prefer the convenience of shopping from the comfort of their homes. In 2023, American consumers spent approximately $38 billion online during the five-day shopping period from Thanksgiving through Black Friday and Cyber Monday. Experts predict that spending will grow by 8.8% in 2024.
But where the money goes, cybercriminals typically follow, and cybercriminals have found plenty of ways to exploit retailers by utilizing bots, web scrapers, and fraudulent traffic. The rise of AI, bots-as-a-service, and other advanced technologies has made it easier and more cost-effective for cybercriminals to launch sophisticated attacks.
Last year, we investigated bot activity on Black Friday and found that bots and fake users made up 35.7% of all online shoppers on Black Friday. Among the forms of fake traffic we uncovered were malicious scrapers and crawlers, sophisticated botnets, fake accounts, click farms, proxy users, and illegitimate users committing eCommerce-related fraud.
As we approach the upcoming Black Friday to Cyber Monday weekend, businesses must begin planning their defense strategies against bots, web scrapers, and fraudulent traffic. Cybercriminals have likely already devised their plans to target your online business. This Black Friday, online retailers need to be prepared to confront these cybersecurity threats. Let’s explore some of the most common threats retailers will face this holiday season.
Account Takeover (ATO) Attacks
Account Takeover (ATO) Attacks occur when bots or attackers log into legitimate accounts in order to access and control them, either by attempting to log in using a list of stolen user information purchased on the dark web (credential stuffing) or through brute force attacks (cracking).
Once in control, bad actors may leverage these accounts to make fraudulent transactions or steal discount codes, cashback balances, or even personally identifiable information (PII) and financial data.
Distributed Denial of Service (DDoS) Attacks
DDoS attacks aim to disable a target website or application by flooding it with a massive volume of fake traffic, frequently carried out by massive botnets, in order to use up the target’s upstream bandwidth or overwhelm supporting network infrastructure and take it offline. For retailers, aDDoS attack can slow traffic to a crawl, or even render a website or app unusable for potential customers, and of course, a customer who can’t access your store can’t make a purchase.
Cart Abandonment
Cart abandonment attacks occur when bots add large quantities of products to shopping carts, making those items temporarily unavailable to genuine customers. By leaving these carts without completing the purchase, the bots create the illusion that high-demand products are out of stock. Such attacks can be orchestrated by competitors or hacktivists to disrupt a business, driving potential customers away and impacting sales.
Ad Injection & User Journey Hijacking
User journey hijacking or ad injection is the illicit use of injected third-party software that redirects the customer during the shopping and checkout process, either through fake ads or other means, thus disrupting the e-commerce flow and attracting them to visit another site.
User journey hijacking causes higher cart abandonment, lower conversion rates, and higher cost of conversion.
A site visitor is not aware that it is happening since the injected ads look like a native component of a website, so a potential customer is most likely to click on these ads. The alarming fact is that these visitors are usually the highest-converting customers.
Content and Price Scraping
Web Scraping is the process of extracting information such as product details, pricing, and other proprietary content from a website without the owner’s permission. This data is often used for competitive purposes, such as undercutting prices or republishing content to attract customers without consent. Competitors may use this information to adjust their pricing strategies, ensuring they offer lower prices to draw customers away from the original site.
Fake Account Registration
The process of creating a new account for a service, software, or store is designed to be a relatively frictionless process. Attackers take advantage of the ease of the process, using fake or stolen identities to create hundreds or thousands of new user accounts for future use.
This practice can be overlooked, as the creation of new accounts is a positive metric. Attackers can use these accounts to abuse your marketing promotions, validate stolen credit card information, or make fraudulent transactions.
Protect Your Revenue with Go-to-Market Security
For businesses serious about safeguarding their marketing pipeline and paid campaigns, CHEQ’s comprehensive go-to-market security platform offers real-time detection of invalid traffic from bots and fake users. CHEQ protects your acquisition, engagement, and conversion efforts while ensuring the accuracy of your marketing analytics.
With CHEQ, you can:
- Protect your paid marketing investments from fraud and waste by eliminating bots and invalid users from your audiences, campaigns, and remarketing efforts.
- Prevent invalid form fills and stop fake users from entering your sales funnel.
- Uncover the impact of bots and invalid traffic across digital initiatives by integrating in-depth detection data with your web analytics and BI systems.
CHEQ leverages thousands of signals to evaluate site traffic in real-time, determining whether a visitor is legitimate, suspicious, or invalid, and allows you to take appropriate action, such as blocking or redirecting that user. Our platform delivers protection that prioritizes performance, with unparalleled detection speed and accuracy, custom-calibrated to meet each client’s unique needs while preserving user experience.
CHEQ provides invalid traffic visibility and protection where it matters most, with seamless integrations to ad platforms, marketing automation and CRM systems, and marketing analytics tools.
Book a demo today to see how CHEQ can protect your go-to-market efforts.
Author
Jeffrey Edwards
Content Marketing Manager
Jeff is the resident content marketing expert at CHEQ. He has several years of experience as a trained journalist, and more recently in his career found a knack for communicating complex cybersecurity topics in an approachable yet detailed manner.
