Brits should have their wits about them this festive shopping season, with cybercriminals looking to get hold of the most in-demand items this Christmas. And it’s often due to ‘bad bots’ and other AI tactics, according to Thales, bots now account for over half (53%) of all traffic to retail websites – overtaking humans for the first time – making this the most automated and most hostile Christmas shopping season on record.

Thales monitors and helps mitigate over 500,000 AI-driven attacks every day, and during peak sales periods bots grow significantly more aggressive. Last year saw a 283% spike in Account Takeover (ATO) attacks over Black Friday, and in 2025 retailers are experiencing 71 million AI-generated automated requests per day.

Replicating the actions of legitimate, human customers online, bots can cause havoc when they’re deployed at scale. Whether it’s overloading websites and services to make them unusable, or quickly snapping up in-demand products to resell before anyone else can get a look in, these bots unfairly tip the scales against legitimate customers with significant impact. The Thales 2025 Data Trust Index found one in three customers globally voiced frustration with ecommerce, directly caused by the manipulation of the customer purchasing process by bots.

And it isn’t just the checkout pages under attack. In 2025, 64% of bot attacks on retail targeted APIs – the behind-the-scenes systems that power stock levels, pricing, checkout and loyalty points – making availability and pricing even more volatile for shoppers

Five gifts cybercriminals will be targeting this Christmas

• Games Consoles & Video Games – Whether it’s handheld devices like the ROG Ally X, or big-ticket items like the PlayStation 5, Xbox Series X/S or Nintendo Switch 2, limited-release drops will be hot targets. Scalper bots can buy stock in seconds, and even once gamers are online, account takeover attempts may be used to steal upgrades, logins or in-game assets.
• Concert tickets – With huge artists touring the UK in 2026, bots will be lying in wait on ticketing sites to submit instant automated requests the moment tickets go live. Touts use these tools to snap up thousands at once, widely considered one of the biggest drivers of poor fan experience.
• Sports tickets – With the Premier League in full swing, tickets for January fixtures will be hard to secure. Scalping activity has grown following a summer sporting season where football, tennis and darts events saw extensive bot abuse.
• Flights – Travel remains the most targeted industry for bad bot activity, accounting for 27% of all such attacks. Bots perform “seat spinning” – holding seats in reserve to push prices higher – and abuse airline APIs to interfere with availability, last-minute pricing and even fulfilment operations.
• Smartphones – High-demand flagships like the iPhone 17, Google Pixel 10 and Samsung Galaxy S25 are prime targets. Bots sometimes hold devices in shopping carts without purchasing, creating artificial scarcity and skewing retail pricing. With 39% of all retail traffic now driven by bad bots, shoppers may see products go in and out of stock within minutes.

Ultimately, any product or experience where supply is scarce and demand is high will see bad bots pounce. Whether it’s limited-edition clothing or trainers, the toy every kid wants this year, or prime-time bookings to a favourite restaurant, without protection, bad bots can get the upper hand. It all leaves customers missing out when Christmas shopping for loved ones.

So, what to look out for?

• Unusual Price Fluctuations: Rapid or inconsistent price changes could indicate bots scraping and manipulating pricing data.
• Slow Website Performance: Bots can overload servers, causing websites to slow down or become unresponsive. If a site is unusually slow, it might be under a bot attack.
• Frequent CAPTCHA Challenges: Encountering CAPTCHAs too frequently could suggest that the site is experiencing high bot traffic.
• Unexpected Availability Changes: Sudden and frequent changes in product, ticket, or flight availability might be due to bots reserving and releasing items or tickets.
• Suspicious Emails or Messages: Be cautious of unsolicited emails or messages offering deals that seem too good to be true, as they could be attempts to lure you to fraudulent sites.

What should consumers do?

If you spot signs of unusual activity when Christmas shopping, flag it to the retailer, avoid artificially inflated prices and be cautious of third-party resellers. Staying vigilant can help prevent falling victim to scalpers, inflated resale markets, or bot-driven account compromise during the busiest shopping period of the year.