Holiday Season Attack Patterns and How to Prepare

The fourth quarter concentrates two things attackers want: transaction volume and distracted operators. The patterns repeat every year, so preparation is a checklist rather than a guessing game.

What increases

• Card testing. Automated attempts to validate stolen card numbers with small purchases on your checkout. It costs you gateway fees, chargebacks, and eventually your processor's patience.
• Credential stuffing against customer accounts, using passwords leaked elsewhere.
• Phishing aimed at staff, often impersonating shipping notifications, vendor invoices, or your own executives, in a period when everyone is processing more email faster.
• Fake order and refund scams targeting overwhelmed support staff.
• Denial-of-service extortion timed for peak trading days, when downtime is most expensive.

Preparation that fits in one afternoon

1. Rate-limit checkout and login. Most card testing is defeated by throttling attempts per IP and per card, plus a bot-detection layer at the edge.
2. Turn on your processor's fraud rules and set a review threshold appropriate for your average order.
3. Two-factor authentication everywhere, for staff and offered to customers.
4. Brief the team on the specific scams, especially any change to payment details, which should always be verified by phone using a known number.
5. Confirm your CDN or firewall's protections are actually enabled, not just purchased.
6. Take a verified backup and know your restore time.

Watch three signals daily

Failed payment rate, failed login rate, and unusual traffic patterns. All three move well before the damage becomes obvious, and all three are visible in dashboards you already have.

Have the plan written

Who to call at your host, your processor, and internally, at 11pm on a holiday weekend. The plan does not need to be sophisticated. It needs to exist somewhere other than one person's memory, and everyone who might need it should know where it is.