Black Friday 2026: the NCSC's shopping checklist, and how to apply it before 27 November

Every year the same pattern repeats: a rush of too-good-to-be-true offers, a flurry of text messages about missed deliveries, and a wave of lookalike shops. Black Friday in the UK is on 27 November 2026, with Cyber Monday following on 30 November, so now is a good moment to tidy up your defences. The NCSC, the UK's national technical authority for cyber security, publishes a compact guide to shopping online securely. This article walks through its advice and adds the practical steps that make it stick.

1. Check the shop before you trust it

The NCSC points out that scam sites routinely copy real logos and product photos and use lookalike domain names. Its advice is to research any unfamiliar retailer using reviews from sources you trust, and not to click links in unexpected messages. Instead, type the address you know into the browser, or search for the retailer and read beyond the first result, because adverts can sit at the top.

• Read the web address letter by letter before you enter anything.
• Be suspicious of a brand-new shop selling a hard-to-find product far below the usual price.
• Bookmark the retailers you really use, so you never need to follow a link from a message.

2. Pay in a way that protects you

This is the single most valuable habit. According to the NCSC, a credit card purchase is often protected under the Consumer Credit Act, while a debit card payment offers less protection, although you may be able to claim a refund through the voluntary chargeback scheme. If you pay with PayPal, Apple Pay or Google Pay, read the terms to see what cover they offer. The guidance is blunt on one point: never pay by direct bank transfer.

3. Hand over as little as possible

Fill in only the mandatory fields at checkout and use guest checkout unless you expect to become a regular customer. The NCSC also recommends not letting your browser save payment details and not letting a shop keep your bank details. It is also a good time to look at the data your favourite shops already hold: our article on the ASOS data breach shows why fewer stored details means less to lose.

4. Lock down the accounts that matter

Use a strong, unique password for each important account, in particular your email, banking, payment and shopping accounts, and turn on two-step verification (2SV) wherever it is offered. Even if a criminal learns your password, 2SV stops them signing in. If a service offers passkeys, they are the easiest option of all: see our guide to passkeys in the UK.

5. Report what looks wrong

Reporting takes seconds and helps others:

• Forward suspicious emails to the NCSC's Suspicious Email Reporting Service (use the link on the NCSC site).
• Forward suspicious text messages to 7726, which is free and lets your mobile provider act.
• Report scam websites to the NCSC, and scam adverts to the Advertising Standards Authority.

If you have been caught out

Tell your bank straight away, using the number on your card or the official website rather than anything in a message. If you were tricked into paying, report the crime to Report Fraud (England, Wales and Northern Ireland) or Police Scotland. If an item never arrives or is not as described, Citizens Advice explains how to get your money back.

A ten-minute pre-Black Friday routine

1. Check that 2SV is on for your email and your main shopping accounts.
2. Delete saved card details from browsers and shops you rarely use.
3. Choose a credit card (or a payment service with clear cover) as your default for online purchases.
4. Bookmark the retailers you plan to buy from.
5. Agree a family rule: no one pays by bank transfer for an online order.

None of this needs special software, and all of it comes straight from the NCSC's own guidance, which is worth reading in full before the sales begin.