Everything we know about Cyber Month: what consumers did, what fraudsters tried, and what merchants need to know
Inflation, eCommerce, and AI - Oh, My!
Cyber Month 2025 defied expectations. Defined by lingering economic uncertainty, the emergence of agentic commerce, and the dominance of online channels, this peak season presented an unpredictable risk environment. Despite worries beforehand about what the wider economic situation might mean for eCommerce, shoppers showed up. Forter processed 18% more GMV during Cyber Week 2025 vs 2024, and on average, merchants saw a 5% increase in processed GMV.
We leveraged our global network of 400,000 businesses and more than 2 billion shoppers to analyze what truly happened this holiday season. This report provides the essential data, analysis of evolving fraud tactics, and targeted recommendations you need to ensure your fraud strategy is prepared for 2026.
FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON FRAUD RINGS INDUSTRY BENCHMARKS AGENTIC AI THE PEOPLE'S MONTH BOT ATTACKS SCAMMING SEASON
The Report
People are spending more, while getting less.
18.9%
Average Cart Size (# items)
A YoY comparison of our global data shows us that shoppers are spending more money on fewer items.
Spotlight on Physical Goods
This shift is even more pronounced when we look exclusively at physical goods. Comparing Cyber Month 2025 to 2024, orders were slightly up, but this is largely driven by items being more expensive.
6.4%
Average Item Price
3.06%
Average Order Value
12.9%
Average Order Value
21.4%
Average Item Price
23.4%
Average Cart Size
Spending with Intention
This pattern points to a more intentional approach to spending. As prices rise and economic uncertainty persists, driven by factors such as inflation, tariffs, supply chain pressure, and geopolitical instability, consumers are becoming more selective about what they buy.
Rather than filling their carts, shoppers are waiting for promotions, focusing on higher-value items, and making more deliberate purchase decisions. In short, shoppers are still willing to spend, but only on the items that matter most, and often only at the right price.
Spotlight on BNPL
9.3%
Buy now, pay later (BNPL) payments were 9.3% higher during Cyber Month than the rest of the year, signaling heightened consumer focus on budget and financing options during the peak shopping season.
The data indicates that shoppers are prioritizing flexibility and spreading debt to lock in limited-time discounts. For consumers who intentionally wait for sales on high-value items, using BNPL at checkout can provide the necessary budgeting cushion to capitalize on deals.
in Buy Now, Pay Later payments
Cyber Month ❤️ AI Referrals
2025 was the very first agentic commerce Cyber Month, and while mainstream adoption is limited, agentic referrals are a steadily growing source of traffic.
AI referrals increased noticeably during Cyber Month, showcasing that shoppers relied on AI tools for product research and personalized recommendations. This trend suggests AI is actively shaping purchase decisions and potentially driving conversion for items beyond the shopper's original list.
Shoppers who discovered products or brands via AI converted at higher rates than usual during Cyber Week, highlighting the importance of investing in discovery and engagement tools like GEO/AEO.
Nearly half of agentic orders placed during Cyber Week came from users completing an order with an AI agent for the first time. While agentic orders are still a small portion of overall transactions, this sizable share of first-time users suggests that functional incentives—like Cyber Week deals—can encourage shoppers to try agentic commerce.
Agentic referrals are visits to a merchant’s site that come through an AI chatbot such as ChatGPT, Gemini, Claude, or Perplexity. The AI guides the shopper to the site by recommending a product or sharing a link, making the AI the source of the traffic rather than search, social, or direct channels.
Who's Using Agentic Commerce?
Industries with the Most Agentic Transactions:
Fashion
QSR
Travel
+40%
Cyber Month AI Referral Growth
+23%
Increase in AI Referral Conversions during Cyber Week
47%
Cyber Week Agentic Orders Driven by First Time Users
The Curious Case of the Chatbot Referral
Fake Accounts Increase
Cyber Month’s intense commercial pressure creates an environment where merchants naturally dial down friction to keep conversions high. Resellers, fraudsters and opportunistic abusers know this, and they’re quick to take advantage.
In fact, 7% of account creations were linked to multi-account abuse
+33%
Spike in Multiple Account Abuse During Cyber Week
Abusers created multiple accounts for the following purposes:
75%
Coupon Abuse
15%
Returns Abuse
10%
Other
Most multiple-account activity isn’t driven by genuine customers chasing an extra deal, it’s resellers creating accounts at scale. These actors don’t drive loyalty or profitable growth. They erode margins and divert resources from real shoppers.
increase in the proportion of reseller traffic during Cyber Month
+25%
Resellers Flock to Sites during Cyber Week
AI Altered Images Fuel 15% increase in Return Fraud
So far, AI-altered damage images like these have increased refund abuse use cases by over 15% and we’re seeing the problem across verticals, from apparel to food delivery, electronics, luxury items, beauty and more.
"It’s like pulling off a heist in broad daylight with the store’s blessing.”
Refund Fraudster
+33%
Customers Buying From a Merchant For the First Time
As we’ve been seeing for the past few years, shopping doesn’t cluster around Black Friday and Cyber Monday like it used to. While it still remains the high point of the shopping period, the data shows that merchants are kicking off holiday deals earlier in the month and consumers are spreading out their purchases.
October and November Shopping Traffic
Black Friday
Cyber Monday
FRAUD AND ABUSE TRENDS
Cyber Month at a Glance
Cyber Week is a Global Shopping Event
+62%
Germany
+16%
Canada
+24%
Japan
+24%
Mexico
-9%
UK
-27%
France
+47%
Brazil
+403%
Argentina
+300%
Dominican Republic
-48%
Turkey
Traffic Spreads Across November
Customer Acquisition Surges
The data indicates that consumers were less brand-loyal during the peak shopping period. Customers are purchasing from merchants they’ve never shopped with before, suggesting shoppers were more exploratory, actively comparing options and trying new brands in search of better prices, availability, or promotions.
Industries with the Largest AI Referral Spikes:
Beauty
Fast Fashion
Tickets
Travel
Countries with Largest AI Referral Growth:
Brazil, Mexico, India, Spain, Italy
$5K flooring
Most expensive item from agentic referral:
US State with the most agentic transactions:
California
Agentic Users Mobile vs. Desktop
75% Mobile
25% desktop
+10% Higher on Desktop
Conversion rate for agentic referrals
As the tech and its tools keep evolving, merchants need to keep an eye on which GenAI platforms are sending the most referrals to their sites. For now, ChatGPT is the clear winner, but plenty of folks like Perplexity, and Gemini 3 has had some rave reviews and only came out mid-November. Copilot and Claude are out there too. Things move so fast with GenAI that all merchants can do is watch this space - especially on your own site!
2025 Top Emerging Fraud MOs
Account Takeover was up 32% during cyber month
This acceleration can be attributed to AI-enhanced phishing and social engineering techniques. Using black-hat AI tools like Fraud GPT, criminals are operating campaigns at a massive scale, easily spinning up messages that perfectly mimic a brand's voice and communication style, making them nearly indistinguishable from legitimate communications.
This heightened level of mimicry and automation substantially increases the success rate of social engineering and phishing campaigns. Consequently, the higher return on investment has attracted more fraudsters to attempt ATO.
Remote Device takeover is up 44% YoY
Remote device takeover (RDT) exploded in October 2025, with $15M in fraud attempts tracked so far. This surge has been driven in large part by GenAI-enabled malware. Although RDT represents just 2% of total Cyber Month traffic, its proportional share of total fraud volume has doubled over the past two years. Looking ahead we expect this trend to continue.
Remote Device takeover is a fraud technique in which attackers gain control over a user’s device, allowing them to observe activity, intercept credentials, manipulate sessions, and act on the user’s behalf without detection. Once a device has been taken over, the attacker can collect all user activity on the device, including keystrokes, login information and payment data.
Return Fraud is up 15% YoY
So far, AI-altered damage images like these have increased refund abuse use cases by over 15%. This acceleration is driven by the fact that return fraud is now one of the quickest fraud MOs to execute. With new GenAI tools, fraudsters can now create compelling images to show fake damage in a matter of seconds.
Cyber Month has proven itself to be a peak shopping period worldwide. The map displays the countries with the largest YoY transaction volume growth.
Fraud Breakdown During Cyber Month
29%
50%
9%
10%
50% Stolen Credit Card
29% Account Takeover
10% Reputation Takeover
9% Return Fraud
2% Remote Device Takeover
Top Verticals Targeted by Resellers:
Footwear, Electronics, Cosmetics, Apparel
Oct. 1
Nov. 1
~20% Increase in traffic from early Oct. to mid Nov.
Succeeding in 2026
Cyber Month 2025 confirmed the fundamental shifts occurring in digital commerce. Shoppers are more intentional than ever, agentic commerce has officially arrived, and the increased sophistication and automation of fraud and abuse is expanding the risk surface for merchants.
To protect profit margins and support agentic commerce, fraud and risk leaders should focus on three strategic priorities to succeed in 2026.
Automate fraud defenses across the full customer lifecycle.
Treat abuse as a strategic threat to margins and customer experience.
Prepare for the growth of agentic commerce
Abuse is rising in both frequency and sophistication as automation lowers the barrier to entry, and tactics such as returns abuse and promotion abuse are scaling quickly. The growing impact of abusive behavior on your bottom-line means that abuse can no longer be treated as an acceptable tradeoff for growth.
Agentic traffic is becoming a meaningful source of transactions, with shopping agents acting on behalf of legitimate, highly intentional consumers. At the same time, fraudsters are using AI agents to scale abuse. Organizations must be prepared to support this new channel without expanding their risk exposure.
1
2
3
Understanding the Identity Behind Every Transaction
To effectively block fraud, approve legitimate customers, and prepare for the continued rise of agentic traffic in 2026 and beyond, merchants need the ability to identify the true identity behind every transaction.
In practice, this looks like having the ability to access and analyze:
Comprehensive user data - (email address, phone number, address) for investigation and review
The user’s browsing, purchase and post-purchase history across a global network of shopping activity
Cyber intelligence data - e.g. IP address, browser info, VPN usage, etc.
Device intelligence data - e.g. device type, settings, language, timestamps, jailbreak status, etc.
Behavioral analytics: how they navigate the site/app (includes browsing behavior, if they copy/paste, time on pages, etc.)
Behavior comparison: Does this behavior match how this user typically behaves? (i.e. Is this potential ATO)
General behavioral analysis: does this behavior match legitimate behavior on your site or is it associated with fraud/abuse? Does this person act how they're expected to behave?
Ability to reconcile user identity across different sessions and devices to be able to have a full view of activity
Without having access to this level of data for all of their shoppers, merchants are left with an incomplete view of who is behind each transaction, forcing them to choose between increased fraud exposure or unnecessary friction for legitimate customers.
Automated attacks
are the new normal
Historically, when bots generated identities for their fraud attacks, they relied on simple, predictable patterns, using low-quality and obviously fake identifiers such as random names or generic email addresses. But this year, we’re seeing a significant increase in the average complexity per fraud bot.
Fraudsters always chase the same goal: maximum payoff for minimum effort. While that goal hasn’t changed, Cyber Month 2025 marked a turning point. Armed with new AI tools and unprecedented volumes of stolen data, fraudsters entered the shopping season with more sophistication and efficiency than ever before. A year over year analysis shows that the proportion of automated fraud attacks has increased 210% YoY.
What once took high-level technical skills is now accessible to a first-time, amateur fraudster with new AI tools. In fact, 20% of the users committing fraudulent activity during Cyber Week were actually newly created identities. This lowered barrier to entry is reflected in the surge of new fraudsters entering the ecosystem this holiday season.
FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS FRAUD TRENDS
Bot Complexity is Increasing:
YoY Growth in Real Personal Identifiers Used by Bot Rings:
2.3%
This data illustrates a key shift: modern bot operations are increasingly leveraging real personal data tied to actual individuals, rather than synthetic or nonsensical identities. Enabled by AI and access to data leaks, bot rings now impersonate real people using genuine names, email addresses, and shipping details, significantly increasing the sophistication, credibility, and risk of bot attacks. Access to accurate personal information, combined with the ability to generate thousands of sophisticated variations, dramatically increases attack effectiveness. As a result, these bots are now deployed across all major fraud vectors, including traditional stolen card fraud, account takeover, refund fraud, and other MOs.
Historically, most bot traffic was malicious, and merchants could safely block all bots to protect their business without any negative impacts. However, that is no longer the case due to the emergence of agentic commerce. As AI agents are increasingly adopted by consumers, a growing share of bot traffic now represents legitimate activity by good bots acting on behalf of tech-savvy shoppers. A blanket policy of blocking all bots risks declining “good bots” and legitimate transactions. During this past holiday season, Forter observed that 2.3% of total site traffic came from bots, with 90% originating from malicious bots and 10% from legitimate use.
This 10% figure is notable given how new agentic traffic is this season, highlighting that the growth of agentic commerce is already underway. While the number of consumers using bots to make purchases on their behalf remains relatively small, the growth of this traffic is clear. And as adoption increases, it’s critical for merchants to ensure that their fraud controls can accurately detect a good bot from a bad bot.
Bot Traffic During Cyber Month
Names +50%
Emails +160%
Shipping Addresses +74%
Of total traffic came from bots
of those bots were good bots
10%
of those bots were bad bots
90%
ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS ABUSE TRENDS
Interested in receiving more reports like this one?
Fraud isn’t slowing down anytime soon. As attackers continue to scale and evolve, merchants must evaluate whether their fraud stack is equipped for what’s coming next. Without the right systems in place, rising automation, abuse, and agentic traffic will continue to erode margins and force tradeoffs between security and customer experience. Now is the time to assess whether your technology and partners are aligned with your growth goals and capable of supporting the next phase of digital commerce.
Fraud is increasingly automated, with GenAI enabling attacks across sign-up, login, checkout, account changes, refunds, and post-purchase activity. Protecting your business now requires automation across every touchpoint.
During Cyber Month 2025, AI referrals drove a significant increase in first-time buyers, bringing in 2x to 3x more new customers than traditional discovery channels. Shopping with the same retailer, buyers who arrived via an AI chatbot received a higher average discount (19%) than buyers who arrived through non-AI channels (15%).
This pattern suggests that price-sensitive consumers are using AI to actively search for the best available deals, rather than shop based on brand loyalty. As AI makes comparison shopping faster and easier, merchants may face increased competition for price-sensitive customers who are more willing to switch brands for better value.
This report draws on data from both Cyber Month and Cyber Week. Cyber Month covers November 1st-December 1st, while Cyber Week spans November 28th-December 1st.
Fraudsters know that merchants are in a tough position, and they’re planning to capitalize on it while they can:
AI-Driven Fraud is here to stay.