Five Types of Shoppers You’ll Find This Holiday Season (and the Cyberscams They Must Watch Out For)

1. The Planner

You can spot a planner miles away! Planners have their presents wrapped and ready, months before the holidays. Making and planning purchases well ahead of time, Planners often save their credit card information, log ins and other personal information on shopping sites.

Most likely to fall for: Credential Stuffing

During such attacks, attackers use lists of compromised user credentials to breach into a system via malicious bots, based on the assumption that many users reuse usernames and passwords across multiple services.

Tips to protect against credential stuffing:

• Be wary of saving payment details on merchant websites. While this may be convenient, it can leave data vulnerable if the merchant is breached.
• Practice good password hygiene, by setting up different passwords for different sites. Better yet – use a password manager to set up unique, difficult-to-guess passwords.

The opposite of Planners, Last-Minute Shoppers often remember its sale day on 11.11 or 12.12 itself, just before the clock strikes midnight. They snag their deals, but it’s always down to the wire for them!

Most likely to fall for: Phishing

In their rush, the Last-Minute Shopper is likely to accidentally click on untrustworthy links and fall prey to phishing scams. What appears to be an email from a reputable retailer with a coveted discount may be fraudulent, but the last-minute shopper doesn’t have time to check.

With the rise of online marketplaces, this is becoming more common. Earlier this year, Singapore's most popular peer-to-peer sales platform was affected when attackers posing as legitimate buyers directed victims to a fake bank website where they would be asked to give their banking details to receive payment. This resulted in at least 72 people losing over $109,000.

Tips to protect against phishing

• Verify the validity of sites before clicking on them or providing any personal information.
• If emails are unsolicited, be alert to any potential errors. Do not proceed if it includes wrong information, or requests to enable macros, adjust security settings or install applications.

The price point is the most significant purchase consideration for these shoppers, who would sift through various sites to get a substantial deal.

Most likely to fall for: Social Engineering Attacks

Bargain hunters would be likely to click on spoofed emails or accept malicious extensions that function as price comparison tools.

Attackers prey on buyer’s eagerness for a good deal by sending them fake offers that request their personal data on a page, even impersonating legitimate tools like Google Analytics or Google Tag Manager to compromise code and steal valuable information, impacting shopping sites.

Tips to protect against social engineering attacks

• Always verify the validity of the offer and the legitimacy of the sender.
• Use a good spam filter for emails, as a first barrier of defence against suspicious files and links.

Driven solely by emotions, impulse shoppers often do not have a specific product in mind before placing an order. They often respond to time pressure to access a coveted item on a limited time offer, at a price too good to refuse.

Most likely to fall for: Brand Impersonation Attacks

Via fraudulent links, cybercriminals impersonate popular brands, tricking victims into sharing personal information, buying contraband products, visiting a fake website, downloading malware, and more. Exacerbating these trends is social media, where attackers can easily impersonate brands, engage with customers seeking to purchase items, and request for their personal details.

Tips to protect against brand impersonation

• Scrutinize links provided in emails and be on high alert if they are not pointing to the correct location or direct to a third-party site not affiliated with the brand.
• If in doubt, reach out to the brand on their official channels to verify offers before clicking on any links to make payments. Make sure to check that accounts are verified.

Researchers extensively compare products and offers before purchasing. They often have various browser extensions installed on their browsers to make quick comparisons.

Most likely to fall for: Extension Malware Attacks 

Cybercriminals hide viruses behind add-ons, which can then install adverts, gather users' browsing history, and seek login credentials by impersonating famous apps and extensions. Malicious extensions could go undetected especially if security software programs treat known extensions as trusted applications.

Most recently, attackers have been using information-stealing malware like FB Stealer, which mimics the harmless and standard-looking Chrome extension Google Translate, to prey on users. Financially motivated, attackers after effectively locking a user out of their Facebook account, abuse access to ask the victim's friends for money.

Tips to protect against extension malware attacks

• Only install extensions from official Web stores.
• If permissions that extensions require even before installing seem suspicious, it’ll be best not to install them.