Is identity theft a risk during the holidays?

It's the most wonderful time of the year—for identity thieves: not only are consumers distracted by a flurry of holiday activity, but they’re also doing a lot of shopping. In fact, the average consumer plans to spend around $875 on gifts, decor and food for the holidays, according to holiday shopping data from the National Retail Federation.

So it's not surprising that 29% of respondents in the 2023 Holiday Norton Cyber Safety Insights Report had been targeted by a scam during the holiday season. Here's how to be on the lookout for the most common activities that put you at risk for holiday identity theft, and how you can help safeguard your identity.

Q: I do my gift shopping online and offline, but either way I’m always a little worried about holiday identity theft. Should I be?

A: It's good to be aware of holiday identity theft and to take precautions to help avoid it, whether you're shopping online or in person. It pays to be cautious with both. Start by shopping with a credit card instead of debit card to limit the exposure of your bank information and access to your cash.

When shopping online, you may want to add an extra layer of privacy and protection by using either a payment service like PayPal or a virtual credit card number, a temporary card number linked to your account that can hide your real card number from retailers.

When you make a purchase in a store, ideally you'll tap or insert your own card. If you must hand your card over to a store employee, watch the transaction and make sure your card gets charged only once.

Whether you're shopping online or in brick-and-mortar stores, keep a close eye on your bank and credit card accounts during the holiday season. Whenever you make a purchase, make sure it shows up with the correct amount and that you don't see any unauthorized transactions or double charges. Also, you may want to give yourself the gift of peace of mind by signing up for an ID theft monitoring service for added protection from identity theft during the holidays and into the new year.

Q: I sometimes do last-minute holiday shopping at a coffee shop or at the airport during a layover. Do I need to fire up my VPN just to buy stocking stuffers?

A: Even if you're in a rush to get your list checked off, the answer is yes. It's always a good idea to use a VPN (virtual private network) any time you're going to use public wifi, especially when logging into accounts or making financial transactions. A VPN allows you to use public wifi more safely and helps protect you from ID theft.

There are many risks of using public wifi. Criminals can take advantage of lax security to use special devices to "sniff" or "snoop" on wifi traffic. This may help them to see what you're doing online and grab your private information to commit ID theft. They can also install malware on your device to help them spy on you and snag your private information.

If you're serious about protecting your identity, either avoid public wifi altogether or use your VPN any time you get online in a public place. It's also smart to take other safety measures, such as visiting only secure sites and using multi-factor authentication on all of your accounts, including email and social media. This protects your accounts by making you enter two or more credentials, such as a password and a temporary code, to log in. Don't forget, these accounts contain a treasure trove of personal information you want to keep out of the hands of ID thieves.

Q: I want to support small businesses while doing my holiday shopping, but I worry about ID theft and scammers. How can I check to make sure a new-to-me retailer is legit?

A: You may have heard the phrase "shop small" and decided to take heart while playing Santa this year. Supporting small businesses is great, but you may have to do a little more legwork to make sure a retailer is legitimate when shopping online. In addition to ID theft, risks of shopping with a shady seller can include Black Friday or Cyber Monday scams where the item you order never arrives, or you get junky merchandise that you can't return.

To make sure a seller is reputable, look at their website and make sure it loads quickly and looks professional. Search the site for a physical address for the business. You can also look for a Better Business Bureau profile and online reviews of the business: While reviews aren't foolproof, a sleigh load of complaints can be a red flag to stay away.

Also check the seller's return policy and read the fine print. Finally, look to see if a seller offers PayPal as an option at checkout. If a seller is "PayPal verified," that's a good sign.

Q: I plan to do a lot of traveling and shopping this season. What can I do to lower my risk of identity theft during the holidays?

A: Your risk of holiday ID theft may be higher when you're out and about, whether you're running out to grab the trimmings for a feast, standing in line to check out during a Black Friday rush, or catching a flight across the country for a family holiday gathering. That's because many identity thieves get your information by physically stealing it from you, whether that's attaching a skimmer to a gas pump, grabbing your payment information in a store or snatching your wallet.

Keep holiday ID theft top of mind whenever you leave home. You can start by paring down your wallet, carrying only the identification and one or two credit cards you plan to use and leaving your debit card tucked safely at home when you can.

When getting gas for your holiday road trip or grabbing cash from an ATM, check for a skimmer first. A skimmer is a device a criminal can attach to these machines to steal your payment card information. This is a big problem: skimming cases grew by 20% in the first half of 2023, according to FICO. In addition to learning to spot a skimmer, get your cash from a bank teller or an ATM inside a bank rather than a machine in the corner of a convenience store or on a busy street.

Be aware of your surroundings while shopping or traveling, and consider using an RFID-blocking wallet to prevent ID thieves who use RFID skimmers to pick up private information from credit cards or passports that use radio frequency identification technology.

When you stay in hotels, don't leave your ID and credit cards in the room while you're out, even in a hotel safe. It turns out hotel safes are surprisingly easy to breach. And watch out for fraudsters who call your room claiming to be from the "front desk" and asking for your credit card number or other information.

Q: I'm always seeing ads for trendy accessories, fun holiday ornaments and other cool products on social media. Is it safe to click on these tempting ads to make my holiday shopping easier, or could it be a scam?

A: Holiday season or not, it's always best to go directly to a retailer's website if you're interested in buying their products. Some holiday scammers will use ads, direct messages, texts and other tactics to advertise "deals" that are too good to be true. The holiday shopping season is prime time for this type of trickery.

In fact, Facebook ad scams soared during and after the pandemic, taking in holiday shoppers who spot a photo of what looks like the perfect holiday gift. Instead, a fraudster may have stolen a merchandise photo from a legitimate seller and posted it on social media to rake in cash or personal information such as names, addresses, and credit card numbers from unsuspecting shoppers.

Follow these tips for staying safe from identity theft during the holidays, and you can stay merry this season and start the new year off with a clean slate.