Fraudsters at sales steal not cards, but user accounts

However, in 2026, the focus of threats shifted: instead of stealing bank card data, attackers switched to attacks on accounts, sending links to phishing sites through social networks, messengers and email. Account hijacking has now become the backbone of the scheme, not an attendant risk. The trend was reported in the press service of MegaFon.

In past years, scammers have been betting on phishing that simulates trading. For example, in the sales season of 2024, the number of attempts by subscribers to switch to fake resources increased by almost a third compared to the average annual values, while traffic on marketplaces grew by only 13%. Then phishing sites copied the design of stores, offered large discounts, and in the final, when the user entered bank card data for allegedly “paying the order”, they actually leaked to scammers.

This year, attackers are no longer hunting for payment data, but for the accounts themselves in social networks and instant messengers. These imitation sites account for up to 40% of all attacks, while fake marketplaces dropped to fourth place. Fraud during the sales period is not focused on direct “payment”, but on the manipulation of “trust”.

The scheme of work is based on several classic scenarios adapted for the trading season. First, these are messages in messengers or social networks about “personal discount”, “closed sale” or winning a gift certificate. Second, bait in the form of a “gifted subscription” or “voting for a child” – even these classic tricks in the fall are supplemented by trade stories, but as a result, the link leads to the authorization page, where the victim voluntarily enters data and loses access to the account.

When scammers gain access to an account, the victim’s chats become a trusted channel. On the list of contacts, malicious links are sent, access to closed communities, documents and files stored in the account is opened. Thus, the attacker involves more and more users in the scheme, spreading links to malicious resources among them. At the same time, the operator does not have the technical ability to warn subscribers about the risks, since calls and messages are made directly via the Internet, bypassing the mobile infrastructure and its antifraud systems.

A similar trend is recorded by Mail in mailings masquerading as letters from marketplaces and online stores. Already in early November 2026, the number of blocked emails with spam and phishing increased by 5% compared to the same period last year. At the same time, attackers adhere to the tactics of transitioning to personalized scenarios, adapting the content of letters to the interests of recipients.

Classical phone fraud has decreased significantly, attackers are increasingly working in areas with maximum trust of people – personal correspondence. In the sales season, this trend mimics: a message about a discount from friends is less likely to cause suspicion. We recommend installing two-factor authentication: it turns a stolen password into a useless set of characters. Do not ignore the warnings of any security systems: from the operator, phone or antivirus. And the main thing: never believe too good offers, even if the message came from a friend. It is better to call him back by phone or check the information on the official website of the brand, said Sergey Khrenov, director of the department for the prevention of fraud and loss of income.

During the sales season, fraudsters use a personalized approach: they offer an additional discount on a popular product, send a unique promo code or report a problem with an order. Links lead to fake store sites, where users are asked to log into an account or enter bank card details. The information obtained can be used to steal accounts or money. To protect yourself, we recommend checking the sender’s address, as well as making orders only through official pages, commented Dmitry Moryakov, head of the Mail Mail’s spam analysis group.