The number of financial phishing is expected to increase during the holiday season, which unofficially begins on Black Friday and continues through Cyber Monday and Christmas. Retrospective research by Kaspersky Lab shows that over the past few years, the holiday season has seen an increase in phishing and other types of attacks, suggesting that the trend will repeat itself this year. 
A peak sales period is naturally also a peak period for criminals and their hunt: stores are offering great deals and consumers are planning to spend money on gifts for themselves, their friends and relatives. So, as e-commerce customers make wishes for the upcoming sales, shopkeepers themselves prepare their stores for a big increase in the number of visitors, and owners of financial infrastructure – banks and payment systems – prepare for a huge increase in the number and value of transactions, digital criminals are also preparing. At least, that has been the trend in recent years.
As Kaspersky Lab’s threat statistics show, in 2014 and 2015 the proportion of phishing pages targeting financial data (credit card information) detected by the company in the fourth quarter (covering the holiday season) was about 9 percentage points higher than the average for the year. Specifically, the result for financial phishing for the whole of 2014 was 28.73%, while the result for the fourth quarter was 38.49%. In 2015, 34.33% of all phishing attacks were financial phishing, while in the fourth quarter, this type of phishing was responsible for 43.38% of all attacks.
The holidays affect the type of financial targets that criminals target. In both 2014 and 2015, Kaspersky Lab researchers observed a significant (several percentage points) increase in phishing attacks against payment systems and online stores. Attacks against banks also increased, but at a lower rate.
In their attempt to steal payment data, criminals use different methods: they may create a fake payment page from a famous payment system, or copy authentic online store websites, or even create 100% fake stores with incredibly attractive offers.
And of course, criminals are exploiting the very spirit of Black Friday. During a threat landscape survey in October 2016, Kaspersky Lab researchers discovered a fake Black Friday-themed online store that offered products at attractive prices. This means that weeks before the actual holiday sales start, criminals are already preparing.
“In 2014, we conducted research into how the phishing during the holidays, and we discovered that the number of attacks against specific targets – payment systems and well-known retail chains – increased during the Black Friday and Cyber Monday. In 2015, this trend was repeated, and this makes us believe that it will happen again in 2016. So we urge consumers to be as careful as possible when shopping online during this period,” said Andrey Kostin, senior web content analyst at Kaspersky Lab.
To avoid falling victim to holiday phishing attacks during the upcoming Black Friday, Cyber Monday and Christmas season, Kaspersky Lab experts advise the following:
- Don't click on links you receive from strangers or suspicious links you receive from friends on social networks or via email. They may be malicious, designed to "download" malware to your device, or lead to phishing websites designed to collect your data.
- Do not enter your credit card information on unknown or suspicious websites to avoid putting it in the hands of cybercriminals. If these websites offer big discounts that seem too good to be true, they are most likely owned by criminals.
- Always check that the website is authentic before entering your data or confidential information (at least look at the URL). Fake websites can look exactly like the real ones.
- Install a security solution on your device, with built-in technologies designed to prevent financial fraud. For example, Safe Money technology in Kaspersky Lab solutions creates a secure environment for financial transactions at all levels.
Phishing is one of the most prevalent digital threats that users may encounter during the holidays, but it is not the only one. Read more about other types of threats to customers, retailers and banks that are likely to emerge this holiday season in Kaspersky Lab’s Holiday Digital Threat Overview on the dedicated website Securelist.com.
Read more about what businesses can do to protect themselves from digital threats during the holiday season on the Kaspersky Business Blog.
