The Big Question: Are retailers facing new risk over cyber protection amid rising buyer concerns?

Black Friday is becoming the biggest shopping day of the year as increasing numbers of shoppers look to fill their Christmas buying needs online.

However it has come at a cost. The day, which this year falls on 29 November, has also been dubbed Black Fraud Day as criminals and scammers look to make the most of the public’s willingness to spend.

It has reached the point that the UK’s cybersecurity head has warned shoppers to be careful amid fears that criminals are looking to us artificial intelligence to trick shoppers.

The festive season had become “prime time for cybercriminals” as consumers hunted for deals, said Richard Horne, the chief executive of GCHQ’s National Cyber Security Centre (NCSC) told the media. Fraudsters were “targeting bargain hunters with increasingly sophisticated scams, sometimes crafted using AI, making them harder to detect”, he added.

With Action Fraud data revealing more than 16,000 reports of online shopping fraud over last year’s festive period, we are urging people to shop safely online – especially if you’re buying on social media – and avoid being left empty-handed for the holiday season.

However for retailers the threat is that the fear of being defrauded will see shoppers shun online purchases and it is an issue they have sought to raise with insurers in what is becoming a very different type of cyber risk.

With insurers aware of the concerns they have looked to understand if there is an emerging risk and what can be done to mitigate it.

Ian Summers, Global Business Leader, AdvantageGo.

The hope is that millions of shoppers are preparing to go online to make the most of the traditional Black Friday but one insurer warns that the level of a retailer’s cybersecurity is now becoming a major buying decision. As such it may herald a need for businesses to be more open on the strength of their cyber defences.

David Warr, Portfolio Manager for Cyber, at QBE reveals that the insurer’s research has found more than 80% of British Black Friday shoppers, which equates to approximately 30.2 million people, say the cybersecurity of online retailers is important to them.

He explains according to the research, Black Friday shoppers are 59% more likely to shop with an online retailer with a strong cybersecurity policy published on its website, a 4%-point increase from 2023.

“Two in three UK adults, around 36.5 million people, say they shop on Black Friday, one of the biggest online shopping events of the year. Globally, the UK ranks third largest e-commerce market by online sales,” Warr adds. “During last year’s Black Friday sales, UK shoppers spent £3.45 billion online, representing a 5.6% increase on the prior year.”

With the number of systemic cyber-attacks doubling since 2020, and high-profile cyber incidents such as NotPetya, the research indicates consumers are increasingly more aware of cyber criminals and thinking about how to protect themselves when shopping online.

Warr says: “As shoppers become more aware of cyber risks and the need to protect themselves online, businesses must improve and better demonstrate their cybersecurity policy.”

Warr continues, “Online criminals and hackers are becoming increasingly sophisticated and quicker at launching cyber-attacks, business owners must take proactive measures to protect their data and reassure customers amid potential third-party disruptions. As we head into the festive period, it’s more crucial than ever for online retailers to have a comprehensive cyber policy.”

He explains according to QBE’s latest research on businesses and cyber, in the last 12 months, the majority (69%) of medium to large sized businesses surveyed were disrupted by cyber-attacks and 78% of IT decision managers are concerned about cyber threats they may face. 

The number of shoppers who said they did feel  the cybersecurity of the retailers was important was a 7% increase on this time last year.

“Retailers can no longer ignore cybersecurity: ahead of Black Friday, 83% of online shoppers say it matters to them, up 7 points from last year,” Warr cautions. “It is basically most of them. The level of awareness has gone from high to ubiquitous.

“Cyber-attacks have hit the NHS, some local councils and the London tube. People are very aware of the risks and the consequences.

He says the 83% figure should act as a warning to online retailers that their security will become a more significant part of the buying decision.

“For businesses who want to boost sales around Black Friday, consumer trust is crucial,” he says. “They need to protect consumer data if they want to build that trust, as it plays an increasing role in purchasing decisions. Their cybersecurity has never been so important to their commercial success.

However with 69% of businesses disrupted by a cyber-attack in the past year there is a discussion to be had around whether companies are doing enough to take steps to become more resilient.

“Cyber criminals will take advantage of emerging technologies,” Warr says. “It is not so much how businesses prevent attacks as how they respond to them. In that respect, only 36% of businesses having an incident response plan is a bit disappointing. It is not enough.”

He adds there is a key role for insurers when it comes to retailers and their cyber security.

“Insurers can help businesses identify and fix vulnerabilities,” Warr explains. “By combining financial coverage with advisory support, insurers become partners in building resilience.”

He adds QBE has been working with its clients to increase resilience in the lead up to Black Friday but that its advice was applicable throughout the year.

“Businesses need to keep critical systems up to date with security patches,” he adds. “You need to monitor all applications and systems exposed to cyber threats.

“Establish an incident response plan and ensure you have adequate cyber insurance in place, and importantly provide ongoing cybersecurity training for employees.”