Published on November 1, 2026 · The mitza.es team
Black Friday 2026 falls on Friday, November 27, and Cyber Monday on Monday, November 30. For an online store these are days of peak revenue. For scammers too: people shop in a hurry, compare prices and are less suspicious of an email or an ad with an eye-catching discount. INCIBE, Spain's national cybersecurity institute, sums it up in one sentence: distrust impossible bargains. What gets talked about less is the other side, the real store whose name is used to deceive. This guide is written for you, the seller.
How they can impersonate you
- Clone websites: a site that copies your design, your photos and your logo, with an address almost identical to yours (INCIBE warns of URLs that change just one letter), to take payment for orders that will never arrive.
- Fake emails and messages: “your order is on hold”, “your account needs verification” or coupons that lead to a page asking for card details, sent as if they came from you.
- Fraudulent ads on social media using your brand or impossible discounts that lead to fake websites.
- Fake QR codes stuck on posters, flyers or parcels. You will find the details in our guide to QRishing.
- Your own website compromised: if someone injects malicious code into your payment page, your customers will pay the right store but the card details will go somewhere else. It is the kind of attack known as web skimming.
What it means for you (even if it isn't your fault)
The scammed customer can't tell the fake website from the real one: they complain to your store, open claims, leave negative reviews or ask for a refund. Even if you have done nothing wrong, you lose time, reputation and sometimes sales. The best defense is for your customers to be able to recognize you and for it to cost a scammer more to pass themselves off as you.
Protect your domain and your email: the foundation
- Set up SPF, DKIM and DMARC. These are DNS records that let mail servers check that a message really comes from your domain. With a strict DMARC policy (starting in monitoring mode and tightening later), emails that impersonate your address are rejected or go to spam. The steps are in our comparison of Google Workspace and Microsoft 365.
- Keep your certificates up to date. An expired padlock in the middle of Black Friday scares the customer and pushes them toward sites that look more “secure”. See the changes to the deadlines in our article on SSL/TLS certificates.
- Control your domain and your DNS: make sure the domain is in your name, with two-step verification at the registrar. We go into detail in domain and hosting.
- Consider registering the obvious variants of your domain (other extensions and common typos) if your brand is well known.
Lock down the buying process
- Keep the store updated (platform, plugins and themes) before the campaign, not in the middle of it. Attacks on outdated plugins are common; see our analysis of a critical WordPress vulnerability.
- Use a recognized payment gateway with strong authentication, so that card data doesn't go through your server. Compare them in how to choose a payment gateway.
- Limit access to the admin panel: long, unique passwords, two-step verification and fewer users with administrator permissions.
- Make a backup before the campaign and check that it can be restored.
- Watch for changes to your website's files, especially on the payment page, to detect scripts that shouldn't be there. It is part of good website maintenance.
Make it clear what the real you looks like
Many scams work because the customer doesn't know how you would write to them. Put in writing, on your website, in your email footers and on your profiles:
- Which email address and which phone numbers you communicate from (and that you only use your own domain).
- That you will never ask for card details by email, WhatsApp or message.
- What your official web address is and which are your verified profiles.
- How to contact you if something doesn't add up.
Monitor your brand during the campaign
- Search for your brand and your domain on Google and on social media several times a week during the two weeks before.
- Set up alerts for your trade name.
- Run a reverse image search on your best-known product photos to detect copies.
- Ask your customer service team to flag it if several customers mention a website, an email or an ad they don't recognize.
If you are impersonated: response plan
- Document: dated screenshots, addresses, order numbers or messages received.
- Warn your customers through your official channels, with a clear note and without alarmism.
- Request a takedown of the fake website from the hosting provider and the registrar, and report the ad on the platform where it appears.
- Report it to the National Police or the Guardia Civil, and notify INCIBE (017, or by WhatsApp on 900 116 117).
- Be empathetic with anyone who has been scammed and give them whatever evidence they may need to claim from their bank.
What INCIBE recommends to the buyer: share it with your customers
One way to help them is to spread the official advice: check that the store has an https address and a valid certificate, visible contact details and reviews; use payment methods with protection (card, virtual cards or recognized services such as Bizum, PayPal, Google Pay or Apple Pay); check the address before paying and keep the receipts; and, if there is fraud, call the bank to cancel the card, gather evidence and report it.
And don't forget the rest of the campaign
Security is one part; the other is making sure the store withstands the peak in visits and orders. You will find the full list in our guide to preparing your online store for Black Friday, and if you are thinking of setting up a store, see how much it costs to create an online store.
How we can help at Mitza
We get your store ready before the campaign: security review, backups, email and certificates. If you are building or redesigning your store, see our ecommerce development service, or tell us about your case on the contact page.