Black Friday & Cyber Monday Online Safety

Spotting a fake shop or deal

The government campaign says that around Black Friday and the festive season criminals create fake websites and target social media, auction sites and marketplaces, selling everything from laptops and concert tickets to holidays.

• Be wary of pressure

  The NCSC says scammers often claim that offers are only available for a limited time or that products are scarce, to manipulate people into acting quickly and handing over money or personal information. Take a moment before paying, however good the offer looks.

• Check the shop before you pay

  Citizens Advice says a company's address should have a street name, not just a post office box, and that you should look for reviews on different websites rather than relying on the reviews the company has put on its own site. You can search for a company's details on GOV.UK to see whether it is a registered company. The NCSC says fake shops often use a deceptive web address that can be easily mistaken for the genuine one. The padlock in the browser's address bar does not guarantee you are buying from a real company.

• Go to the shop directly

  For a link you are unsure about, the NCSC says to type the organisation's official website address into your browser yourself, or to search for the organisation and take time to read the results page rather than just clicking the top item.

• Pay in a way that protects you

  The NCSC advises using a credit card if you have one, because many credit card payments for online purchases are protected under the Consumer Credit Act. Debit card payments offer less protection, although you might be able to claim a refund under a voluntary scheme called chargeback. The NCSC and Stop! Think Fraud both say never to pay by bank transfer. The NCSC also suggests checking out as a guest rather than creating an account for a shop you will not use again. This is advice for the adult who is paying; a parent or carer should be the one using their card.

• Protect the accounts you shop with

  Stop! Think Fraud advises protecting your online accounts with passkeys wherever they are available, or 2-step verification as a secure alternative.

Delivery texts, gift cards and payment demands

• Delivery messages

  Stop! Think Fraud warns that criminals impersonate delivery companies, sending messages about undelivered parcels that take you to a fake website, where they can steal your money and personal information or infect your device. It lists requests for payment before delivery of a parcel, or because you have lost a parcel, as a warning sign. Check a delivery request is genuine by contacting the organisation directly through its official website or app, and avoid clicking links in unexpected messages. Not every delivery message is fake: Royal Mail says it only contacts people by email or text if the sender asked for tracking updates, does not ask for payment for an underpaid item by email or text (it leaves a grey Fee to Pay card instead), and may send a text or email about customs fees where the sender has provided your contact details.

• Gift cards are not a way to pay

  Amazon says legitimate individuals and businesses won't ever ask for payment through Amazon gift cards, and that once a scammer receives a gift card claim code they will most likely have spent the funds before you have contacted law enforcement or Amazon. Citizens Advice lists being asked to pay in an unusual way, such as by iTunes vouchers or through a transfer service like MoneyGram or Western Union, as a sign that something may be a scam. Apple says its gift cards can only be used to buy products and services from Apple, and tells people not to give the numbers on the back of a gift card to someone they don't know well or haven't met.

• Threats attached to a payment demand

  Amazon lists a demand to buy gift cards under a threat to share private or sensitive information as a known gift-card scam. If a child or teenager is being pressured or threatened over images, read our sextortion guide. Childline is on 0800 1111, 24 hours a day.

Teens buying and selling online

Teenagers often meet sales through resale apps, social media and game stores. Here is what the platforms and official sources say.

• Resale and ticket listings

  Stop! Think Fraud lists last-minute ticket posts on social media, and incredible offers for sold-out events that no one else can supply, as warning signs. Stop! Think Fraud says criminals target social media, auction sites and marketplaces. Talk through these signs with your teenager before they buy from anyone they do not know.

• Check the age rules before a teenager lists anything

  Vinted's UK help centre says users must verify that they are at least 18 years old, and that minors can only use Vinted under the supervision of the adult account holder. Depop's terms of service, effective 6 October 2026, say anyone aged 13 or over can use Depop. Our marketplace safety guide for teens covers Vinted, Depop and eBay in more detail.

• Free in-game currency and item offers

  PlayStation warns that scammers promise free vouchers, gift cards or in-game items to get people to scan a QR code, and says never to scan a QR code sent to you by another person, even if they claim it offers a reward. It also warns about unexpected direct messages from other players or on social media that pretend to offer exclusive opportunities or claim there is a problem with your account, and says never to share account information with websites offering free virtual currency in exchange for personal information. Epic says it does not partner with any third-party V-Bucks sellers, and warns that buying from unofficial sellers risks losing money without receiving any V-Bucks, and that sharing your account details may result in your account being compromised.

Stopping surprise spending

A child on a family account is usually spending an adult’s money. Each control below covers some kinds of spending and not others, so check what each one covers.

• Apple: Ask to Buy

  Apple says Ask to Buy and Ask to Browse are on by default for children under 13. With Ask to Buy on, when a child wants to download an app, buy an in-app purchase or redownload a shared app, you get a notification with their request. If you dismiss a request or do not approve it within 24 hours, the child has to ask again. Apple says the family organiser pays for everyone's purchases unless they turn off Purchase Sharing. For the settings, see our iPhone and iPad guides.

• Google Play: purchase approvals

  Google says a parent in a family group can require family members to get their permission to purchase or download content on Google Play. In the Play app the setting is called Purchase approvals; in the Family Link app it is Require approval for. Google says these settings only apply to purchases made through Google Play's billing system. The family manager is responsible for purchases made with the family payment method and gets an email receipt each time. We could not find Google saying whether redeeming a gift card on a supervised account needs approval, so keep the card yourself until you have tested it.

• Gift cards and codes: don't rely on Ask to Buy

  Apple's own help pages don't agree on whether a child redeeming a code needs your approval, and Apple doesn't say what happens with a gift-card balance. Don't rely on Ask to Buy to stop gift-card or code spending: keep the card or code yourself until you've set the account up and tested it.

• Xbox: Ask a parent

  With Ask a parent switched on, a parent gets an email when a child wants to buy a game or app and needs help funding it. Xbox says the purchase-approval setting does not apply to using currency or Xbox gift cards.

• PlayStation: vouchers and spending limits

  A PlayStation child account has no payment method of its own, and a new child account's monthly spending limit starts at 0. Sony says PlayStation Store wallet top-up voucher codes must be redeemed on the family manager's account, not the child's, and the manager can then set a monthly limit for the child. A voucher code works once, and Sony will not replace it if it is lost, stolen or used without the owner's permission.

• Nintendo: block purchases

  Nintendo's eShop spending restrictions are set in the parent's Nintendo Account rather than on the console. A tick box disables purchases and automatic renewal.

• Read the PEGI label before you buy

  PEGI's In-game purchases descriptor always appears when in-game content can be purchased. PEGI defines Paid random items, such as loot boxes and card packs, as in-game offers where players don't know exactly what they are getting before the purchase, and now lists them as a separate descriptor. Video games with paid random items that have been submitted to PEGI since June 2026 will be PEGI 16, or PEGI 18 for social casino games. From October 2026 PEGI has also begun updating the age ratings of a selection of existing digital-only games that are currently rated PEGI 3, 7 or 12 and feature paid random items to PEGI 16. PEGI says the updates take some time to complete across storefronts, so a store may not yet show the new rating for every game. PEGI also has a Time-limited offers descriptor for in-game offers that are only available for a limited time or in limited quantities, creating a sense of urgency.

If something goes wrong

• Money lost or an account hacked

  If you have been tricked into making a payment, the NCSC says to tell your bank and report it as a crime to Report Fraud (for England, Wales and Northern Ireland) or Police Scotland (for Scotland). Tell your bank as soon as you realise. If someone calls and you think they are trying to trick you into handing over money or personal details, Citizens Advice says to hang up and call 159, a secure service that connects you directly with your bank. Check that your bank uses 159 first.

• Report Fraud and Police Scotland

  In England, Wales and Northern Ireland you can report online at reportfraud.police.uk at any time, or call Report Fraud on 0300 123 2040. Report Fraud (formerly Action Fraud) says it will never request your bank details. In Scotland, report to Police Scotland by calling 101. If a crime is happening right now, call 999.

• Scam texts and emails

  Most phone providers are part of a scheme that lets customers report suspicious text messages for free by forwarding them to 7726. The report goes to your phone provider; if 7726 doesn't work, contact your provider to find out how to report it. Forward scam emails to [email protected], which goes to the National Cyber Security Centre. The NCSC says it can't tell you the outcome but does act upon every message received.

• Fake shops and scam adverts

  The NCSC says it has the power to investigate and remove scam websites, and that it is free to report a suspicious website to it. The Advertising Standards Authority runs a form for reporting online scam ads in paid-for space, such as ads on newspaper websites, paid search ads or ads on social media; reports are shared with the NCSC. The form is not for ads that are merely misleading or that appear somewhere else, such as a company's own website or a press or TV ad.

• A problem with a purchase

  In England and Wales, the Citizens Advice consumer helpline is 0808 223 1133. Calls from mobiles and landlines are free. Lines are open Monday to Friday, 9am to 5pm and are closed on bank holidays, and you can use its online form over the weekend, from 5pm on Fridays to 9am on Mondays. Have to hand when you paid, how much you paid, how you paid, whether you did so in a shop or online, and the seller's name and address. Citizens Advice says it does not investigate scams itself but passes them to Trading Standards.