A third of online Black Friday shoppers were fake: Cheq study

Global cybersecurity company Cheq has estimated that more than a third (35.7%) of Black Friday online shoppers this year were bots and fake users.

The estimates are derived from Cheq’s recent report which studied invalid traffic (IVT) rates by industry, geography, device and threat type. The study was conducted across a pool of over 42,000 websites in North America, Europe and Asia. Cheq applied hundreds of cybersecurity tests to each website visitor to determine their authenticity.

Ecommerce sites were found to be particularly vulnerable, with high exposure to carding attacks, chargeback fraud, data breaches, fake signups and other types of disruptive activities.

Cheq CEO Guy Tytuniovich said that while fake website traffic is a "year-round problem", the company witnessed a "sharp spike" in fraud in the online retail sector this Black Friday, a shopping festival that took place on November 26.

"This is not a huge surprise to us, given the increase in ecommerce activity, a trend accelerated by the global pandemic," Tytuniovich said. "Ultimately, cyber crime follows the money, especially in sectors where business activity is on the rise.”

With retailers typically spending as much as US$6 billion on Black Friday marketing, Cheq estimates that damage to businesses this Black Friday could surpass $1.2 billion. This includes the impact of financial fraud, skewed data and lost revenue.

In total, Cheq estimates that $42 billion in revenue is lost globally each year due to IVT, and an additional $2.5 billion is lost in customer transactions. It estimates that the global cost of data skewed by IVT is $697 billion annually, and $115 billion in sales labour costs is wasted on invalid leads.

The study found that organic and direct traffic has a higher proportion of bots and fake users, at 27% of total traffic, versus paid, at 3.5%.

Online-heavy sectors have highest IVT rates

Sectors that have a high proportion of online purchases, including retail, travel and tourism, and insurance, display higher rates of IVT versus other sectors, Cheq's study revealed. Additionally, industries with a high customer-acquisition cost, like higher education and SaaS, also saw relatively high IVT rates.

The below shows the IVT rates by sector for organic and direct traffic.

The highest levels of IVT for paid traffic were found in finance, gambling and gaming, and computer software/SaaS.

North America and APAC are top IVT regions

North America displayed the highest IVT rates for organic and direct traffic of 25%, which Cheq said suggests that digitally advanced markets tend to attract more invalid, malicious, and fraudulent activity. It is followed by Asia-Pacific at 21% and EMEA at 12%.

When analysing paid traffic, APAC had the highest levels of IVT at 5%, with North America and EMEA both at 3%.

Mobile top target

Looking at device type, mobile has the highest IVT rate for organic and direct traffic of 32%, followed by desktop at 26% and tablet at 16%—correlating with the usage rates of each device.

This flipped in paid traffic, with desktop devices displaying the highest levels at 7%, followed by tablet at 4% and mobile at 2%.