Holiday Fraud Trends 2025: The Top Cyber Threats to Watch This Season

According to data from KasadaIQ, attackers are starting earlier, automating faster, and leveraging artificial intelligence (AI) to blur the line between human and bot activity.

Across the retail, hospitality, and quick-service restaurant (QSR) industries, researchers warn that this year’s fraud landscape may surpass all records in both scale and sophistication.

Fraud operations have evolved into an industrialized ecosystem.

Automation kits, stolen account data, and malicious configurations — known as configs — are traded with the same efficiency as legitimate software tools.

Generative AI is fueling this trend , enabling attackers to mimic authentic consumer behavior and bypass traditional fraud detection systems. KasadaIQ’s analysis reveals that adversaries are pre-positioning for the holiday period with early configuration sales, higher automation, and more adaptive attack patterns.

The convergence of AI, automation, and underground marketplaces means fraud is no longer limited to major shopping days — it is a continuous, data-driven enterprise.

Attackers are no longer waiting for Black Friday.

KasadaIQ tracked a 92% increase in malicious configurations targeting retail and a 400% increase against accommodation industries between January and October 2025. These configurations — scripts used for credential stuffing, scraping, and automated checkout — are now being deployed 10 to 14 days before peak sales.

This shift allows adversaries to test infrastructure, refine attack scripts, and sell proven configurations ahead of the holiday rush.

Organizations that only activate heightened monitoring during Thanksgiving week will likely miss the preparatory attacks that set the stage for large-scale fraud .

Account takeover (ATO) remains the most active vector for holiday fraud.

Kasada’s telemetry found more than 311 million stolen accounts listed across dark web marketplaces in 2025 — 63% belonging to retail brands. Attackers use large-scale credential-stuffing campaigns to access consumer accounts and exploit stored payment data, loyalty points, or shopping carts.

These attacks are often timed in the week before Black Friday , when accounts are fully loaded with value. In just one month, Kasada observed over 1,100 credential-stuffing incidents across 133 retailers, compromising an estimated 265,000 accounts.

Security teams should treat ATO as an ongoing, intelligence-driven campaign, not an isolated event.

Gift cards remain the most effective channel for converting stolen assets into profit.

Kasada identified 8.9 million stolen retail cards and 7.5 million QSR cards listed for sale. Fraudsters favor gift cards because they are anonymous, fast to resell, and difficult to trace. Retail card activity typically spikes before Black Friday and Cyber Monday, while QSR cards peak later in December.

Security teams should monitor for unusual redemption velocity, repeated balance checks, and suspicious API calls that verify card validity.

For the first time, AI-driven bots are expected to account for the majority of holiday web traffic.

Kasada predicts a 520% increase in AI-generated requests compared to 2024. These bots mimic human behavior with random movements, hesitations, and input variability — making them difficult to distinguish from legitimate shoppers.

AI bots are being used to enroll fake loyalty accounts, scrape pricing data, and complete automated purchases within milliseconds. Because many interact directly with backend APIs, traditional web-based rate limiting and pattern recognition are becoming ineffective.

Organizations should adopt behavioral fingerprinting and API-level anomaly detection to combat these threats .

Kasada’s monitoring of criminal forums shows that compromised data now moves from breach to resale in under five days.

Automation has shortened the fraud lifecycle dramatically — attackers steal, process, and sell data before defenders can respond. This speed compresses investigation windows and increases pressure on incident response (IR) teams.

Security operations centers (SOCs) must integrate fraud telemetry into real-time monitoring and leverage automated alerts to identify brand-specific threats early. Collaboration between fraud and cybersecurity teams is essential to match the speed of modern adversaries.

This year’s holiday threat landscape demands faster, smarter, and more unified defenses.

Fraud prevention cannot operate in isolation from cybersecurity operations. To prepare, organizations should do the following:

Editor’s note: This article first appeared on our sister publication, eSecurityPlanet.com .