Q3 2026 Update

Threat Intelligence Report

Where fraud moved in Q3, and the four windows security and fraud teams should prepare for before the holiday season.

Loading form...

What the data says ahead of the holiday season

What changed in 2026

924K+

Automated checkouts claimed in monitored communities this quarter, across 710+ retailers. 36% were collectibles.

+52%

More tracked marketplace listings by September, after a cluster of marketplaces collapsed in August. Half of the sellers who reappeared were trading on a new platform within 18 days.

<$100

To build a synthetic identity that can pass onboarding checks. A clean ID match no longer proves a real customer.

The 2026 holiday threat cycle

The 2026 holiday threat cycle starts before Black Friday

The run-in is already underway. The highest threat week starts on 16 November.

  1. 1 Oct to 15 Nov

    Run-in

    Scraping and fake account creation rise as bots build aged accounts.

    Defender move: Set your agent policy before 1 November.

  2. 16 to 23 Nov

    Pre-position

    The highest threat week. Bot configurations and stock listings surge ahead of the sale days.

    Defender move: Move checkout monitoring forward to this week, and raise protection on login and recovery.

  3. 24 Nov to 1 Dec

    Sales peak

    Bot checkouts on the sale days, then account takeover climbs into Travel Tuesday as stored cards, points and full carts are cashed out.

    Defender move: Gate checkout and account pages to agents acting for a signed-in customer.

  4. 24 to 27 Dec

    Second peak

    Gift balances land and loyalty points get drained while owners are away. In 2025, about 30% of sold accounts carried loyalty points.

    Defender move: Stage points and stored-value freezes so you can trigger them without delay.

Then, refunds.Claims lag purchases by 3 to 6 weeks, from mid-December into January. KasadaIQ tracked a 3.5x rise in Telegram refund fraud signals in 2026.

The run-in, not Black Friday, is where defenders will win or lose the season.

Where does your industry sit?

The Q3 report ranks 11 industries by threat, based on adversary intent and capability. Each industry page maps the behaviors adversaries use and the endpoints they target, across 2,300+ analyst-verified companies.

  1. 01Critical

    Retail & eCommerce

    Automated checkout abuse

  2. 02Critical

    Digital Platforms

    Fake account creation

  3. 03Critical

    QSR & Food Delivery

    Promo, bonus & referral abuse

  4. 04High

    Ticketing & Live Events

    Account takeover

  5. 05High

    Travel & Hospitality

    Loyalty program abuse

  6. 06High

    Finance & Fintech

    Identity and KYC bypass

  7. 07High

    Identity & Access

    Account takeover

  8. 08High

    Gaming

    Account takeover

  9. 09High

    Streaming & Creator

    Fake engagement (viewbotting)

  10. 10Elevated

    Essential & Consumer

    Account takeover

  11. 11Elevated

    iGaming & Wagering

    Promo, bonus & referral abuse

Considerations for defenders

  1. Treat AI as an adversary capability. Adversaries swiftly adapt to static defenses.
  2. Judge the visitor as well as the document. A successful KYC check no longer guarantees a genuine user.
  3. Bring peak-season defenses forward to the week of 16 November, and set endpoint agent policies by 1 November.
  4. Know where your industry sits, and where you sit within it.

What does this mean for your business?

Request a 30-minute holiday threat advisory to review the threat windows and patterns most relevant to your organization.

Request an Assessment

About the data

Quick answers about the Q3 report

KasadaIQ is Kasada’s threat intelligence capability. It collects millions of unique events each day, drawing on criminal marketplaces, adversary communities, and open and closed sources.

Industry data appears in 2 views. The market view covers all tracked activity and shows the big trends. The threat model view looks at 2,300+ analyst-verified brands across 11 industries, so you can see where you sit among your peers.

Sales, stock and revenue figures are modeled from observed stock movement and should be read as directional, not as exact counts.

Learn more about KasadaIQ

KasadaIQ's holiday threat calendar starts on 1 October with the run-in, when scraping and fake account creation rise. The highest threat week is 16 to 23 November, before the sales peak. In 2025, the biggest bot checkout day was 18 November, not Black Friday.

Tracked marketplace listings still rose 52%, from 69.5K in July to 105.6K in September. Half of the sellers who reappeared under the same name were trading on a successor platform within 18 days.

KasadaIQ found that assembling a synthetic identity that can pass onboarding checks costs less than $100, because every component of a KYC check is sold on criminal marketplaces.

Refund fraud is the season's trailing edge. Claims lag purchases by 3 to 6 weeks, so Black Friday orders become refund claims from mid-December into January. KasadaIQ tracked a 3.5x rise in Telegram refund fraud signals in 2026.

More reports

Q3 2026 Threat Intelligence Report: Holiday Bot Threats