Black Friday falls on 27 November this year, and the weeks around it bring a lot of online shopping and a lot of parcels. Many of your team will browse and order from work laptops, work phones and work email addresses, often during the working day.
That makes it an easy time for scam messages to be believed, because everyone is expecting a delivery or a deal.
1. Why does Black Friday increase scam risk for a business?
More people are expecting messages about orders and deliveries, so fake ones are more likely to be opened.
Work and personal shopping also overlap. The same laptop, phone and email account can be used for both, so a mistake made while shopping can reach the business. Scammers now use AI tools to write convincing messages, so spelling mistakes are no longer a reliable warning sign.
2. What do Black Friday scams look like?
They usually look like a delivery problem, an order confirmation, a bargain or a payment query.
- Fake delivery messages. A text or email says a parcel could not be delivered and asks for a small fee, personal details or to click on a link.
- Fake order confirmations. A message confirms an order nobody placed and invites you to click to cancel it.
- Copycat shopping websites. The prices are very low and the site looks like a retailer you know.
- Fake account alerts. A message claiming to be from a well-known retailer says your account needs attention.
- Gift card requests. A message that appears to come from a manager or director asks someone to buy vouchers quickly for Christmas.
3. How can a shopping scam turn into a business problem?
One clicked link can lead to a stolen work password, access to a mailbox, or a payment sent to the wrong account.
If someone signs up to a retailer with their work email address and that retailer is later breached, the same password may be tried against your systems. The busy period before Christmas is also a time when fake supplier emails asking to change bank details can slip through, because people are rushing to finish things before the break.
The impact depends on the business. A law firm has confidential client files in its mailboxes. A FinTech firm holds customer data and approves payments. A gaming operator has customer accounts and financial controls. Regulated firms may also have reporting obligations after an incident, so it helps if staff tell someone inside the business straight away. Your own regulator’s guidance sets out what applies to you.
4. How can staff tell whether a message is genuine?
The safest habit is to go to the retailer’s own app or website, and not to use the link in the message.
A few checks help:
- Be careful with unexpected delivery messages. Treat any that ask for payment with extra suspicion.
- Look at the sender. Check the email address or phone number, and whether it matches the company.
- Notice the urgency. Phrases such as “act within 24 hours” are designed to stop people thinking.
- Check bank detail changes by phone. Call a number you already hold for the supplier, and avoid the details in the email.
5. What should a business do before Black Friday?
A four-step process is enough for most businesses, and it can be done this week.
- Tell staff what to expect. Send a short note about fake delivery messages, fake offers and fake invoices, with a reminder not to use work email addresses for personal shopping accounts.
- Make reporting easy. Give people one clear way to report a suspicious email. If you use Microsoft 365, the Outlook Report Phishing button lets staff report with one click.
- Tighten the payment checks. Require a phone call to a known number before any change of supplier bank details, and a second person to approve it.
- Know what to do if someone clicks. Ask staff to report it straight away and make sure nobody is blamed for doing so. Change the password, tell IT and check the account for unusual activity.
Things to do this week
- Send the staff reminder. Keep it short and put it in the inbox people read.
- Check multi-factor authentication. Confirm it is switched on for every account, including email.
- Remind people about work email addresses. They should stay out of personal shopping accounts.
- Review how supplier bank details are changed. Make sure the call-back check is written down.
- Tell people who to contact. Everyone should know who to tell if something looks wrong.
Where to go for help
- NCSC: report a scam email (forward it to report@phishing.gov.uk)
- NCSC: phishing advice, including forwarding scam texts to 7726
- NCSC: set up the Outlook Report Phishing button for your staff
- Report Fraud: the police service for reporting fraud and cyber crime in England, Wales and Northern Ireland (0300 123 2040)
- NCSC: Cyber Action Toolkit (free)
If you are in Scotland, report fraud to Police Scotland on 101.
If you would like to talk about securing your business, you can book a meeting with me or connect with me on LinkedIn.
