Safe Online Shopping During the Holiday Season 2025

How to shop safely during Black Friday, Cyber Monday, and the Christmas peak: the realities of AI (artificial intelligence) fraud, practical checks, payment protection, GDPR data minimization, and logistics solutions in Lithuania.

Holidays = more purchases, less vigilance

During the holiday season, the rush increases while vigilance decreases — this is the ideal environment for online fraudsters who exploit both psychological pressure (“limited offer”) and advanced technologies. In 2025, the cybersecurity landscape has changed significantly: random, clunky attempts have been replaced by targeted, AI-driven attacks (phishing, smishing, fake online stores, social media ads, and “sale” pages). The scale of incidents in Lithuania is also rising, so it is recommended not to rely solely on the “I’ll recognize it by sight” principle — technical and behavioral hygiene is essential.

From “obvious” to nearly perfect forgeries

1.1. Generative AI and “deepfake” scenarios

Fraudsters replicate the websites of well-known brands down to the smallest details (logos, product photos, customer service content), spreading fake “sales” and directing users to fraudulent payment pages. Stolen creator content or AI-generated “faces” promoting “unbelievable discounts” circulate on social media (especially short-form videos). The result — visual checks (does it “look real”) no longer guarantee safety; technical filters are necessary (URL analysis, domain age verification, review audits).

1.2. Contextual and adaptive phishing/smishing

AI enables the creation of highly personalized emails and SMS, “mimicking” the tone of banks or couriers, incorporating real recent activities. During the holiday season, package delivery scams (“we cannot deliver”, “pay a small fee”) are particularly common. Even experienced users may click on the wrong link, so the golden rule is to check package status through official accounts or apps, not through received messages.

From passwords to biometric measures

2.1. Account management and authentication

Use unique, long passwords and mandatory two-factor authentication (MFA). Biometrics (Face ID, Touch ID) have become a practical standard — in Lithuania, banking apps (e.g., “Citadele”) allow login and action confirmation with “MobileSCAN” and biometrics, thus reducing the risk of AI-based credential theft.

2.2. Technical hygiene and software protection

Regular OS and app updates patch known vulnerabilities; antivirus/anti-malware with browsing protection (e.g., WebAdvisor, etc.) helps block malicious websites and downloads. Email security is a separate pillar: configure email protection, use filters and MFA, and periodically conduct phishing simulations.

2.3. Public Wi-Fi: encrypted tunnel (VPN) – a necessity

Cafes, airports, and shopping centers — convenient but risky spaces. Avoid sensitive operations over public Wi-Fi; if necessary, connect via mobile internet or a VPN, which encrypts traffic and reduces “Man-in-the-Middle” threats.

It’s not enough to see the “lock” icon — check systematically

3.1. Website legitimacy check

• HTTPS and domain: a lock is necessary but no longer sufficient. Check the domain age/owner (WHOIS), whether the URL has “rewriting” errors (typosquatting).
• Contacts and details: a legitimate business provides an address, phone number, email with its own domain, and company name/legal form. If you only see “gmail” — that’s a big red flag.
• Badges and “Trust Seals”: click — they should lead to an independent verification page, not just be an image.
• Third-party platforms: check “sold by”, choose official vendor logistics, monitor the review “profile”, not just the number.
• VVTAT recommendations: familiarize yourself with remote trading rules, 14-day return and defective goods rights.

3.2. AI-based link verification

Avoid relying on your eyes: use URL/phishing checkers (ML models detect redirects, domain anomalies, “spelling” clones). Practice: run any link received from email or social media through a checker first, and when purchasing a more expensive item — also manually check the domain age, details, and delivery/return conditions.

Isolate financial risk

4.1. Tokenization in digital wallets

“Apple Pay” / “Google Pay” uses one-time tokens and transaction cryptograms instead of a 16-digit card number — the actual number does not reach the merchant. This significantly reduces damage even in the event of a breach.

4.2. Virtual cards

Create a “segregated” card with individual limits or one-time use — especially when purchasing from a lesser-known store. If data leaks occur, the risk is limited.

4.3. Biometric identity verification

Biometrics (Face ID / Touch ID) are increasingly used for payment confirmation. They are more resistant to AI “synthetic identity” fraud than passwords, and Lithuanian banking apps support biometrics as an additional layer of security.

4.4. New in Lithuania: IBAN recipient name verification

Since 2025-10-09, Lithuania has enabled verification of the recipient’s name/title against the IBAN of the actual recipient. This reduces the risk of redirecting transfers to fraudsters — the message appears in online banking or the app, not via SMS.

Less data = less risk

The main principle of GDPR is to collect only as much data as necessary. Do not disclose excessive data (date of birth, personal code) in online forms unless required for delivery or invoicing. Less stored data = less context for AI attacks. Familiarize yourself with Article 5 (“principles related to the processing of personal data”) and the right to request the deletion of outdated information.

From SMS scammers to “porch piracy”

6.1. SMS about “stuck packages”

Courier services do not request payments or confidential information through unexpected emails or SMS. Check package status only on official websites/apps by entering the tracking number.

6.2. Parcel lockers — practically the safest option

Omniva / LP Express parcel lockers operate 24/7; packages are picked up with a unique six-digit code received via SMS/email, and for some senders, additional identity verification (Smart-ID / mobile signature) may be required. This reduces the likelihood of both physical theft and digital fraud (you only wait for the code when the package is already in place).

5-minute “security pitstop”

• Link: do not open from SMS/social media — go through the official store or check with URL analysis tools.
• Domain: no spelling errors; check domain age/owner.
• Contacts: address, phone number, email with the company domain (not “free” emails).
• Payment: prefer tokenized digital wallets or virtual cards; for larger amounts — additional limits.
• MFA and biometrics: enabled in bank/merchant accounts.
• Returns: understand the 14-day return rules and the path for “defective goods”.
• Delivery: choose parcel lockers and code pickups; do not click on suspicious “package fee” links.