Singles' Day and Black Friday: The Scam Starts Before the Click

Thousands of scam links in ten months

Between January and October 2026, Hong Kong's cybersecurity alert center, HKCERT, counted 84,312 scam links. These are links that mimic a store so they can take your money. A little history helps explain why. In 2009, Alibaba turned November 11, known as Singles' Day or Double 11, into a shopping festival with just 27 stores. Ten years later, it was selling more than 38 billion dollars in a single day. What started as a celebration is now scam season, because scammers feed on that rush to buy.

A fake storefront that copies every step

When you shop safely, you open the store's app and pay right there. When you shop from an ad, you don't really know where that link is taking you. On November 6, 2026, with the Double 11 sales underway, HKCERT warned that these scams copy every step of the purchase: the store, the payment, the delivery, the refund, and even customer service. That's why everything can look normal from start to finish, even when there's no real store behind it.

How the scam works, step by step

It starts on social media with a page that looks like a well-known brand. The price makes no sense, it says the deal is today only, and the web address looks off. Then the seller messages you: the store is having a problem, and if you pay them directly, you'll get an extra discount. At that point, you've left the platform. If you paid, a so-called refund arrives with another link to confirm your details. Finally, a fake customer service agent asks for the six-digit code your bank texted you, and that code approves a payment.

One code, your card, and the money's gone

That six-digit code is the last piece the scammer needs. With it and your card details, they can make a payment that looks exactly like you made it yourself. The charge shows up as a purchase you approved, which is why it's so hard to dispute later. Looking back, the whole path is short: a deal on social media, a message, a link, and a code. And it all started with one simple click on a deal.

What the warning says, and what it doesn't

According to HKCERT's warning, the goal of these scams is to get you to click or pay outside the official channel before you check anything. The warning talks about phishing, meaning fake messages and pages, and about brand impersonation. It doesn't name a specific phone, app, or version, and it doesn't mention any software patch to install. So the risk applies to anyone who shops online, especially if they arrive through social media links or messages about payments, deliveries, refunds, or customer service.

The numbers: up about 75%

Between January and October 2026, HKCERT recorded 8,764 phishing cases, on top of the 84,312 scam links. According to the warning, that's roughly 75% more than the same period in 2025. These are Hong Kong figures, and the warning doesn't give numbers for anywhere else, so we don't know how many cases there are here. Still, the warning itself makes it clear that the risk applies to anyone who shops online, wherever they live.

Real store or fake store

The difference is simpler than it looks. A real store charges you inside its own website or app and never asks you for codes or passwords. A fake store wants to pull you out of there: it offers an extra discount if you pay directly, sends you links for a refund, or messages you pretending to be support. Any time someone tries to move you off the platform to pay or verify something, that's your red flag.

Four rules before you click

1. 1. Go through the store's app or type the full web address yourself, not through an ad.
2. 2. Pay only inside the store, ideally with PayPal or a virtual card, which is a number your bank gives you just for online shopping.
3. 3. Never give "support" the code you get by text, and never share your passwords.
4. 4. If something feels off, stop responding, call the number on the back of your card, and check the charge.

If you're shopping this Black Friday, you don't need to be tech-savvy to stay safe. Just follow these four rules before you click.