A shopper received a text from their card company. Had they just spent about $400 at Walmart? They replied “No.” An automatic message came straight back: they had already answered. When they phoned the card company, they were told a “Yes” had arrived by email. They hadn’t sent it. Before they could stop it, someone collected one of the orders from a store.
Around the same time, another person described how their joint bank account with their mother, her PayPal and her credit card were drained of about $1,600 through Walmart money transfers. The bank’s and PayPal’s login records showed nothing unusual.
Both stories were posted by victims in an online scam-reporting forum, and both show what Black Friday account takeover looks like. Neither family had clicked a fake Black Friday deal. The thieves didn’t need a fake website. They used a real account at a real store, and the payment methods already saved inside it.
What most likely happened
Neither case was investigated in public, so this is the most likely explanation rather than a confirmed one. The pattern behind Black Friday account takeover is well known to fraud teams, and it usually runs in four steps.
A password leaks. It comes from an old data breach at another site, a fake login page, or malware that steals passwords saved on a phone or computer.
The store account is taken over. The leaked password works because it was reused. Once inside, the thief can spend every card, debit card and PayPal link saved in the account.
The money is cashed out within hours. A pickup order is collected using the barcode in the store’s app, or money is sent through an in-store transfer to an accomplice. Both are fast and hard to reverse.
The victim finds out late. The bank sees a normal purchase at a store the customer already uses, not a stranger logging into their bank. That is why the login records in the second case looked clean.
Often the thief also controls the victim’s email. That would explain the first case: whoever was in the inbox answered the card company’s alert before the real owner did. Attackers in a hijacked inbox commonly set up rules that hide, mark as read or delete specific emails, such as order confirmations and security alerts (Microsoft).
This isn’t a Walmart problem in particular. Any store that keeps your card on file can be used the same way; these two cases just happened to involve Walmart.
Why Black Friday account takeover spikes
Thieves use the year’s busiest shopping days as cover. More logins, more orders and more pickups make it easier for a hijacked account to go unnoticed. It sits alongside the other festive season scams that peak at this time of year.
During Black Friday and Cyber Monday 2025, account takeover attempts rose 13.6% above the year’s average across one fraud-prevention network, and 24% in online retail (Sift).
The average attempted fraudulent online-shop purchase nearly doubled, from $130 to $250. In online shops, thieves went for bigger baskets (Sift).
More than 311 million stolen accounts were listed for sale on criminal marketplaces in 2025, and 63% of them belonged to retail brands, according to security firm Kasada (TechRepublic).
62% of Americans in a 2025 survey said they often or always reuse passwords (NordPass). Every reused password is a key that fits more than one lock.
Across all types of fraud, US consumers reported losing $15.9 billion in 2025, up from over $12 billion the year before (FTC).
The damage also shows up late. Holiday takeovers often surface weeks afterwards, when people finally read their statements (Sift).
What the bank sees, and what it can miss
Our founder spent years on the IT payments side at a major South African bank. Banks run AI fraud checks that record unusual behaviour and flag it for human review. The fraud team then calls the account holder to confirm. They also spot trends, marking strange transactions or patterns for closer attention.
Those systems are good at spotting activity that doesn’t look like you. But a thief inside your own store account, using the card you saved there, at a shop you use every week, can look a lot like you.
And when something does go wrong, a dispute can be logged with the bank, but there is no guarantee you will get the money back. Our founder’s advice is simple:
Treat your cards and account numbers the way you would treat a wallet with cash in it. You don’t leave it where it can be found.
A card saved in a shopping app you rarely protect is a wallet left on the counter.
Stop Black Friday account takeover: the one-hour lockdown
Most of the protection happens before the sales start. Set aside an hour this week, before 27 November.
Secure your email first. Give it a long, unique password and turn on two-step verification. Then check its settings: filters or rules, forwarding, connected apps, and the recovery phone number and email. Sign out of all other devices. Your email can reset every other password you have, so it comes first.
Use a different password for every shop. A password manager makes this easy, and it means one leak can’t open your other accounts.
Turn on two-step verification or a passkey at each store. Many big retailers offer this now. Walmart, for example, supports passkeys, which let you sign in without a password anyone can steal (Walmart help).
Empty the wallet. Remove debit cards, bank links and PayPal from store accounts. If you must keep a card on file, keep one credit card, not a debit card.
Close accounts you no longer use. A forgotten shop account with an old card saved in it is an easy target.
Turn on instant purchase alerts in your banking and card apps, so you see a charge within minutes rather than at the end of the month.
Ask your bank about virtual card numbers. Some banks create stand-in card numbers for online shopping that you can lock or delete, so your real card number is never stored at the shop (Capital One).
Protect your phone number. Ask your mobile provider for a PIN or lock that stops anyone moving your number to another SIM, where they could receive your codes.
Update your phone and computer, and avoid pirated software and “free” apps from unofficial sites. They are a common source of password-stealing malware.
US readers: freeze your credit. It’s free at Equifax, Experian and TransUnion, and stops anyone opening new credit in your name. Elsewhere, ask your bank or credit bureau what protection is available.
Shopping-day rules
Go to the shop yourself. Type the address or open the official app. Don’t follow links in deal, order or “delivery problem” messages, which flood in during November.
Never read a one-time code to anyone. No real store or bank will ask you for it. That code is the last lock on your account.
Answer fraud alerts in your bank’s app, or call the number on the back of your card. Don’t reply to a message or call a number it gives you.
Pay with a credit card rather than a debit card. In the US, federal law caps your liability for unauthorised credit card charges at $50, and the money isn’t taken from your account while the bank investigates. With a debit card, it is already gone, and how much you can recover depends on how quickly you report it (FDIC). Rules differ in other countries, so check with your bank.
Slow down when a deal looks too good, a shop is new to you, or you’re asked to pay with gift cards or a bank transfer.
Do it together with an older parent or relative
The second case involved a joint account with a mother. Older relatives are often the people with the most saved in the bank and the least time spent on security settings. They also tend to stay logged in to the same shopping apps for years. For more on how scammers target older people, see scams targeting older South Africans.
Offer to sit down with them for an hour before Black Friday, on their own device, and go through the lockdown together:
Start with their email, then the two or three shops and apps they actually use.
Remove saved cards together, especially debit cards and anything linked to a pension or savings account.
Switch on purchase alerts in their banking app, so a strange charge shows up the moment it happens. On a joint account, make sure alerts reach both of you.
Agree one simple rule: never give a one-time code to anyone, and if a message or call feels urgent, hang up and phone you or the bank first.
Set up a password manager with them rather than taking over their passwords. The goal is to help them stay in control, not to do it for them.
End by writing down who to call if something goes wrong: the bank’s fraud number from the back of their card, and yours.
Check the shop before you buy
Account takeover often starts somewhere else. A deal on social media, a “your parcel is delayed” text, or a shop you’ve never heard of can lead to a fake checkout page that captures your password or card. During the sales, those links are everywhere.
That is where AdUncovered can help. Before you buy from a website or shop link you don’t know, run it through our Quick Check. It looks at the business side (the website, platform or shop link), not a person, a dating or social media profile, or a conversation. It screens the link against known threat lists and a list of reported scam addresses.
Treat the Quick Check as a first screen, not a clean bill of health. Many scam sites are only days old and don’t appear on any list yet, so a clear result doesn’t mean a shop is safe. Our guide on spotting fake online reviews before Black Friday covers more checks you can do yourself.
If you want to look deeper, our Quick Report and Comprehensive Report research the public information about the business and give you source-linked findings, together with the limits of that research. We don’t give a verdict or a trust score. Deciding needs human judgement, and laws differ from country to country, so the report lays out the evidence and you make the call.
AdUncovered takes no money from businesses, platforms or sellers, runs no ads and earns no affiliate commissions. Your report is seen only by you, apart from limited checks by our team to verify it.
What we can’t do is tell you whether your own store account has been taken over. For that, the lockdown above is your best protection.
Check a shop or deal link before you buy
Keep checking through January
Look at each store account’s order history once a week, including pickup orders and any money transfers.
Treat an unexpected “ready for pickup” email as an emergency. Contact the store straight away, before the order is collected.
Read your card and bank statements line by line. Some holiday fraud only shows up weeks later.
Remove saved cards again once the gift shopping is done.
If it happens to you
Speed matters. It can decide whether the goods leave the store and how much you can recover.
Contact the store to stop the order. Walmart, for example, tells customers to use its chat and type “Unauthorized Charges” (Walmart help).
Call your bank or card company and dispute every charge you didn’t make.
Secure your email first, then the store account. Change both passwords, sign out of all devices, delete saved payment methods, and change any password you reused elsewhere.
Keep evidence: order numbers, the pickup store and time, emails, screenshots, and when you reported it.
Report it. In the US, use IdentityTheft.gov and ReportFraud.ftc.gov, and your local police. Elsewhere, report to your police and your country’s fraud reporting service.
Don’t give up if a dispute is turned down. In one case reported by local TV news in Florida, a card company reversed a victim’s refund after the store said the order had been collected with a valid barcode. The store only marked the orders as fraud after reporters got involved (WFTV). Ask the store to confirm in writing that the order was fraudulent, and send that to your bank.
One hour now, or weeks of disputes later
Black Friday deals last a weekend. Black Friday account takeover can empty a saved card in an afternoon, and getting the money back can take weeks, with no guarantee. Spend an hour this week locking down your email and your shopping accounts, then do the same with someone you love. And before you click a deal from a shop you don’t know, check it with AdUncovered first.
Check before you pay
About to pay a seller or business you don’t know? Start with a Free Quick Check of the advert link. It screens for common warning signs and shows where each result came from.
If you need the seller researched, a Quick Report or Comprehensive Report brings together source-linked Search Results on the seller and the offer. Neither gives a verdict: you check the sources and decide for yourself.
