Black Friday & Cyber Monday: a safe-shopping checklist

Before the sales start

The Cybersecurity and Infrastructure Security Agency (CISA) begins its holiday tip sheet with the device you shop on, not the store. An outdated phone or a reused password can undo every other precaution.

• Update the operating system and apps on every device you will shop from, and turn on automatic updates where you can.
• Use strong, different passwords for shopping and email accounts; a password manager helps.
• Turn on two-factor authentication wherever a retailer, bank or email provider offers it.
• Make a short list of what you plan to buy and from which stores, so a "flash deal" from an unknown seller stands out.
• Note the current price of big-ticket items now. A dated screenshot lets you judge November's "was" prices — see how "was" prices work.

While you shop online

• Avoid shopping or banking on unsecured public Wi-Fi (CISA).
• Reach stores by typing their address, not by tapping links in unsolicited emails or ads (CISA).
• Treat brand-name items at unusually low prices in social-media ads as a warning sign; the FTC says such ads can lead to sites that ship counterfeits or nothing at all.
• Research unfamiliar sellers: search the name or web address with "review", "complaint" or "scam" (FTC).
• Check the total price, refund policy, who pays return shipping and any restocking fee before checkout (FTC).
• Pay by credit card where possible, and never by gift card, wire transfer, payment app or cryptocurrency (FTC).
• Save the receipt and order confirmation number (FTC).

In the store

Store-day planning is less about scams and more about receipts and policies. Holiday crowds also bring practical measures: in 2020, for example, Kohl's described distancing markers, designated entrances and greeters handing out sanitized carts for its Black Friday week. Measures vary by year and retailer, so check the store's own announcements before you go.

• Ask about the return window, especially for sale and doorbuster items, which often have different terms (Washington AG).
• Ask for gift receipts for presents (Washington AG).
• Keep receipts, packaging and tags together until the return period ends.
• Inspect gift cards on the rack before buying: the FTC warns that scammers tamper with cards on store racks and suggests looking for scratched-off backs or removed stickers, telling a cashier if something looks off, and trying a different store if one card has been tampered with.

After you buy: the delivery weeks

The FTC flags a December spike in fake shipping notices: texts or emails claiming a missed delivery or asking you to "update shipping preferences", often with a threat that the parcel will be returned. The links lead to look-alike pages that harvest personal and payment details, or to malware.

• Track orders from the site where you bought them, not from links in messages.
• If a message might be real, contact the carrier through a number or website you already know.
• Check card and bank statements for charges you don't recognize, and report them to your bank right away (CISA).
• If an order doesn't arrive by the promised date, remember the seller must offer you a refund — see returns and refunds.

Quick reference

For a longer look at copycat stores, see how to spot a fake online store.