Phishing attempts are about to surge. 6 ways to protect your business

Your customers are on the lookout for all the best deals during Black Friday and Cyber Monday sales, and scammers know it.

The sheer number of shoppers and sales, plus the deadline pressure to take advantage before offers expire, creates the perfect storm for phishing attempts. Phishing is a type of online scam that targets people and businesses by sending them an e-mail or other communications that appear to be from a well-known source (in this case, a store or brand, tricking them into sharing sensitive information, making payments or opening malicious links or attachments.

“Phishing jumps over the holidays when people are rushed, distracted and more likely to click,” says Jackie Fine, a security analyst at Wix. “Security teams, banks and the Federal Trade Commission all see the same bump every November and December, and Black Friday/Cyber Monday is the peak.”

Here, Wix Domains shares how to secure your website in advance of the holiday shopping (and phishing) rush.

The rise of phishing attempts over the holidays

In 2025, a report by global cybersecurity company Darktrace found that phishing attacks mimicking U.S. retailers increased 201% in the week before Thanksgiving (Nov. 15-21) compared to the same week in October.

Not only are your shoppers at risk of cybercrimes, but so are you as a shop or brand owner. Here’s what you can do to protect yourself against phishing attempts year-round, but especially during the holiday shopping season.

1. Secure your site and all accounts

Remember that your customers aren’t the only targets. You can be one, too. Beware of phishing emails with prompts like “reset before Black Friday,” fake order or tracking texts, fake returns or asks to pay extra shipping, or fake invoices that look like a supplier (Shopify, Amazon, FedEx), Fine says.

To help keep your site secure, Fine recommends setting up the following:

• Check that your domain is locked. If you need a refresher on what “domain” means, it’s your website’s address or URL. Domain lock is a security setting that protects a web address from unauthorized transfers or ownership modification. Many registrars have domain lock turned on as a default.
• Set up two-factor authentication with your domain registrar.
• Add a recovery email to your account with your domain registrar. Use an email account you control, not one shared among employees.
• Turn on auto-renew for your domain registration so that you don’t get stuck with domain expiration during a high-sales moment, which could put your domain at risk of being acquired by someone else.

The FTC also recommends making sure any software, apps or web browsers are updated. You should also reinforce your login security with strong passwords — at least 12 characters long and aren’t reused —and multi-factor authentication on any business accounts.

2. Proactively grab lookalike domains

Domain spoofing is an increasingly big problem for businesses as AI tools make it easier to set up convincing fraudulent dupes of a brand’s real web presence. According to the FTC, “people lost a staggering $3.5 billion to imposter scams in 2025, with reported losses increasing nearly three times since 2020,” and those are just the losses reported to the FTC.

Many scammers use lookalike domains — think: beautystore.com vs. beauty-store.com — to intercept customers and steal their data and payment info.

“Customers won’t squint at the URL if the logo looks right,” Fine says. “One fake site on Friday can take a day’s orders, and those people will think it was you.”

To prevent scammers from capitalizing on lookalike domains, you can proactively take control by purchasing some of them yourself. Learn how to buy a domain name, and register a few common variations of your brand URL. It doesn’t make sense to go after every potential URL affiliated with your brand, Fine says; just grab the most common offenders.

“Buy the ones people actually type: the hyphen vs. no-hyphen, your brand with a missing letter, your URL with a different top-level domain [or TLD, for example, .net, .shop, or .store if you only own .com], and the common typo you see often,” she says.

On those sites, set up a simple page that reads “You meant yourbrand.com” and links to the correct URL, Fine suggests. You can also set up redirects so that these additional incorrect domains automatically send visitors to your main site.

3. Watch for copycat sites, ads and accounts

Even with those extra domains under your wing, you should check regularly for copycats, other sites or social media accounts pretending to be your brand.

A November 2025 investigation by cybersecurity company Check Point reported that “seasonal shopping periods regularly trigger spikes” in domain registration, including many brand impersonations. For example, they found that 1 in 25 new domains related to Amazon, AliExpress and Alibaba were malicious.

Fine recommends periodically taking some time to Google your brand plus keywords like “login,” “sale” or “discount” to find potential offenders. “Search for the exact misspellings you already know the customers type, and look up names in your registrar’s search box,” she says. “If a lookalike URL is taken, check to see if it’s impersonating you.”

4. Fine-tune your customer communications

Email security is crucial. Be super clear with your customers about how you’ll get in touch with them. It costs essentially nothing and can potentially save you from headaches and them from being phished.

“Tell customers the one real URL and how you’ll contact them: site, email, Instagram and so on,” Fine says.

Make sure you have one official URL listed in the footer of your emails, in your order emails and in your social media bios. For SMS, use the same number or short code you already use; don’t suddenly text from a new one.

If you use email for orders, also make sure you have email authentication tools set up to make it harder for scammers to send fake emails using your real domain. Fine recommends checking for: 
 

• Sender Policy Framework which verifies that a mail server is allowed to send email for your domain.
• Domain Keys Identified Mail, which adds a digital signature on outgoing email so servers can verify that it was indeed sent from your organization’s servers and wasn’t tampered with on the way.
• Domain-Based Message Authentication, Reporting, and Conformance, which verifies that the actual server address matches the “from” address the recipient sees and can also be configured to tell other servers what to do when they get an email that appears to be from your domain but looks suspicious.

Even if you don’t have the technical know-how, your email or website provider should be able to help you set them up, Fine adds. Encourage your customers to get in touch with you if they’re unsure about any of your brand communications they’ve received.

5. Verify anything that looks suspicious

Keep an eye out for any emails, texts or calls that claim a problem is urgent, ask you for money, claim there’s a problem with your account or login info, ask you to verify personal or financial information, want you to click on a link to make a payment or change payment info or warn about domain-renewal or store-suspension, per the FTC.

If you’ve received suspicious contact from a company you actually use or have an account with, don’t click any links. Navigate directly to the website you know is real by typing it in your browser or contact the company directly with an email or phone number you know is safe. Do not use any info from the suspicious contact.

6. Have a quick-response plan for any threats

In the event of any suspicious activity or if you realize you or your customers have been scammed, get a record of as much as possible. Screenshot everything. Make sure to include the page, URL and ads. Then check the sender’s domain on VirusTotal. Note when it was created and whether security vendors have already flagged it. A domain only days old, or one already marked malicious, is a strong sign it’s a fake.

In the case of a fraudulent website, look up the site registrar with WHOIS, and make a report to the registrar and host, who can investigate and take action, Fine says.

Also report it to Google Safe Browsing or the ad platform, if the website is running ads. If someone is impersonating you or your brand, “tell your customers on your real website, email them and post to your social media platforms: ‘This is fake, we will never ask you to pay here,’” she recommends. “Don’t argue with the scammer, and don’t pay any random ‘takedown expert’ who DMs you to help.”

If any money was sent, contact the bank or payment provider, and recover and secure an account if credentials were stolen. If customer data was stolen, follow the FTC’s business breach-response guide.

If you or your customers have been the victim of a scam, the FTC recommends you report the fraud to the FBI’s Internet Crime Complaint Center and to the FTC. You can also forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and texts to SPAM (7726). Notify your customers about the issue ASAP in an email without hyperlinks, and remind them not to share any personal information through email or text. If any personal customer data was stolen, advise them to go to the FTC’s IdentityTheft.gov for guidance.

This story was produced by Wix Domains and reviewed and distributed by Stacker.