News

Black Friday is coming: check your sale claims, and check no one is pretending to be you

The ACCC will be checking retailers' Black Friday and Cyber Monday advertising for misleading discount claims. At the same time, scammers are using real business names to run fake shops and send fake emails. Small retailers face both risks in the same month.

By G’day Business editorial team · Fact-checked against official sources
Published · 3 min read
Torn black paper revealing a red Sale 50% sign
Photo by Sasun Bughdaryan on Unsplash
General information only. This guide is general information, not financial, legal or tax advice. It doesn't take your circumstances into account. For advice about your situation, talk to a licensed professional.

What’s happening

On 10 November, the ACCC announced its third sweep of retailers’ advertising during the Black Friday (27 November) and Cyber Monday (30 November) sales. For the first time, it will look at websites, emails and social media, not just one channel.

A week earlier, Scamwatch reported that buying and selling scams made up 58.7% of scam reports involving a financial loss in the first nine months of 2026. Scammers impersonated legitimate businesses and familiar platforms, and the National Anti-Scam Centre has taken down 20,353 scam websites so far this year, many posing as online shops.

What the ACCC is looking for

The sweep will focus on:

  • “Sitewide” or “storewide” claims when a large number of products are excluded from the sale.
  • Time-limited offers and countdown timers when the offer continues past the stated end date.
  • Pressure tactics, including misleading testimonials and false claims that stock is running low.
  • Misleading “was” prices, where items were never, or not recently, sold at the reference price.

ACCC Deputy Chair Catriona Lowe said retailers “should not be relying on fine print disclaimers or exclusions” to qualify the headline of a promotion.

The ACCC’s guidance on price displays explains when a “was” price can mislead: if the item wasn’t sold at that price for a reasonable period right before the sale, or only a very small number sold at that price. A “sale” price that runs for a long time may simply have become the normal price.

The simple test: if you can’t back a claim up with your own sales records, don’t run it. If the sale ends on Monday, end it on Monday.

The other risk: someone pretending to be you

Scamwatch says scammers copy business names, logos, ABNs and other details, and use AI to build polished fake shops quickly. Sale season suits them: shoppers expect big discounts, countdown timers and lots of emails, so a fake one blends in.

A small business can be impersonated through:

  • Look-alike websites using your name, photos and products.
  • Fake order confirmations or invoices that appear to come from your email address.
  • Fake delivery texts that use your name to get customers to click a link.

You didn’t do anything wrong, but your customers lose money and may lose trust in you.

Protect your name in the inbox

Three email settings make it much harder for scammers to send email that appears to come from your domain:

  • SPF lists the mail servers allowed to send email for your domain.
  • DKIM adds a digital signature to your outgoing emails.
  • DMARC tells receiving mail servers what to do with emails that fail these checks, such as sending them to spam or rejecting them.

The Australian Signals Directorate’s guide How to combat fake emails recommends using all three, and building up to a DMARC policy that quarantines or rejects fakes. These are settings in your domain’s DNS records. Your email or IT provider can set them up for you.

Tell customers how you’ll contact them

Add a short note to your website, order confirmations and receipts:

  • the email address you send orders and invoices from
  • that you’ll never ask for card details or passwords by email, text or social media
  • how to check a message is really from you, such as calling your listed number.

Watch the money side too

Busy periods are when fake supplier invoices and “we’ve changed our bank details” emails slip through. Before paying a new account, call the supplier on a number you already have, not one in the email.

If you spot a fake

  • Report it to Scamwatch. If a fake site uses your business name, report it to the website host and to the platform where it’s advertised.
  • Warn your customers on your own website, email list and social media, and tell them how to reach the real you.
  • Keep evidence: screenshots, website addresses, emails and dates.

Two checks before the sales start

  1. Every discount you advertise is one you can back up: real “was” prices, real end dates, and headline claims that match the fine print.
  2. Your email domain has DMARC switched on, so scammers can’t easily send email as you.

If you don’t know whether your domain has DMARC, ask your email or IT provider to check it for you.