This holiday shopping season can make or break many Australian businesses. While consumers are shopping for bargains, attackers are searching for vulnerabilities.
The surge in shopping traffic during Black Friday, Cyber Monday and Christmas sales provides cybercriminals with the perfect cover to launch scams and fraud campaigns, exploiting the rise in digital transactions to hide malicious activity.
The Perfect Storm of Old and New Attacks
Attacks like phishing, account takeovers and payment fraud continue to dominate, but they spike during the holidays due to the sheer volume of legitimate traffic, which enables cybercriminals to blend in.
There is also an uptick in more sophisticated scams like logistics fraud, where fake shipping notifications appear to come from legitimate delivery companies, tricking shoppers into paying false “customs” or “tax” fees.
Cyber extortion is also becoming more common. Attackers target e-commerce operations with distributed denial-of-service (DDoS) or ransomware attacks designed to take online stores offline during peak trading periods, knowing that businesses are more likely to pay a ransom to avoid losing critical holiday revenue.
A New Wave of Fraud: “Vibe Scamming”
Generative AI is changing the game for cybercriminals. Vibe scamming, where criminals use AI to automate end-to-end phishing and scam campaigns, is on the rise. With minimal effort, cybercriminals are using AI to democratise their phishing campaigns by generating realistic websites, emails, and messages, and even testing stolen credentials or payment data at scale.
AI also allows scammers to hyper-personalise their communication over social media, email or chat to unsuspecting victims. Criminals scrape information from victims’ social media activity, reviews or shopping history to develop messages that appear authentic and can seem to come from trusted retailers or platforms, making them even more challenging to detect.
Social Commerce: A New Frontier for Deception
The rise of shopping via social media platforms like TikTok and Instagram has created new vulnerabilities for consumers. These platforms are not designed for secure financial transactions and often rely on third-party payment systems for processing. Fake reviews, cloned influencer accounts and counterfeit promotions can spread quickly. This is especially true if a popular influencer account with millions of followers is compromised, misleading their followers within minutes.
Warning Signs Australian Retailers Should Watch For
There are several red flags Australian retailers should be alert to during peak shopping season:
- Small but high-volume payment transactions (e.g. hundreds of 50-cent charges are often used by attackers testing stolen cards)
- Irregular traffic patterns or bursts every few minutes, typical of automated bot activity
- Unexplained spikes in failed logins – a sign of brute force or credential-stuffing attempts
- Outbound connections from internal systems to unknown internet addresses – a potential indicator of ransomware calling home
How Retailers Can Prepare and Defend
Before the holiday rush, retailers should:
- Reassess their entire security posture: It’s no longer enough to scale systems for higher customer traffic; retailers must also prepare for a spike in attacks. This involves ensuring defences can differentiate genuine shoppers from malicious bots, and deploying web application firewalls, DDoS mitigation and bot management tools that can adapt dynamically.
- Implement multi-factor authentication (MFA): This should be a mandatory step for all customer and employee logins. Educating staff and customers about emerging scams and establishing a clear process for reporting any suspicious activity are also crucial.
- Implement security controls for newer technologies such as AI chatbots and APIs: Many attackers bypass website frontends entirely and exploit exposed APIs that often lack adequate protection. According to an Akamai study, over 95 percent of Australian organisations have experienced API-related incidents, indicating the need for immediate attention.
- Updated training and response plans for staff: Front-end and customer-facing employees should be trained on how to spot and handle the latest scam and fraud techniques, while security teams need to update their incident response playbooks around the detection, containment and response to automated and AI-powered incidents.
Managing Third-party Risks
Third-party vendors such as payment gateways and logistics providers can both strengthen and weaken defences. Reputable providers often offer advanced security capabilities, such as fraud detection and PCI DSS compliance, that smaller retailers can benefit from. However, should these partners be compromised, it can create a “backdoor” into the retailer’s own systems through trusted integrations.
Businesses should thoroughly vet vendors and scrutinise evidence of their security controls, like DDoS mitigation and encryption, while continuously monitoring their access., Techniques like network micro-segmentation can also help limit the blast radius if a third-party system is breached.
Top Steps Australian Retailers Should Take If Attacked
Here are key steps Australian retailers should take if they fall victim to a cyberattack:
- Isolate and contain critical systems from the breach and assess the damage
- Coordinate with internal departments (IT, marketing, public relations and legal) as well as notify affected parties such as customers, employees and other stakeholders
- Report the breach to the relevant authorities, such as the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC), and law enforcement
- Alert payment providers and financial institutions to freeze financial transactions
The Bottom Line
A proactive, layered, and adaptive defence strategy is the only way to ensure that the busiest shopping season of the year doesn’t become the most damaging one. Preparation alone is not an option. It’s a matter of survival for Australian retailers and consumers. It’s no longer a matter of if a business will be breached, but when.
